diff --git a/docs/dyn/admin_directory_v1.chromeosdevices.html b/docs/dyn/admin_directory_v1.chromeosdevices.html
index f7a6fce..f4d5e55 100644
--- a/docs/dyn/admin_directory_v1.chromeosdevices.html
+++ b/docs/dyn/admin_directory_v1.chromeosdevices.html
@@ -157,6 +157,26 @@
   &quot;annotatedUser&quot;: &quot;A String&quot;, # The user of the device as noted by the administrator. Maximum length is 100 characters. Empty values are allowed.
   &quot;autoUpdateExpiration&quot;: &quot;A String&quot;, # (Read-only) The timestamp after which the device will stop receiving Chrome updates or support
   &quot;bootMode&quot;: &quot;A String&quot;, # The boot mode for the device. The possible values are: * `Verified`: The device is running a valid version of the Chrome OS. * `Dev`: The devices&#x27;s developer hardware switch is enabled. When booted, the device has a command line shell. For an example of a developer switch, see the [Chromebook developer information](https://www.chromium.org/chromium-os/developer-information-for-chrome-os-devices/samsung-series-5-chromebook#TOC-Developer-switch).
+  &quot;cpuInfo&quot;: [ # Information regarding CPU specs in the device.
+    { # CPU specs for a CPU.
+      &quot;architecture&quot;: &quot;A String&quot;, # The CPU architecture.
+      &quot;logicalCpus&quot;: [ # Information for the Logical CPUs
+        { # Status of a single logical CPU.
+          &quot;cStates&quot;: [ # C-States indicate the power consumption state of the CPU. For more information look at documentation published by the CPU maker.
+            { # Status of a single C-state. C-states are various modes the CPU can transition to in order to use more or less power.
+              &quot;displayName&quot;: &quot;A String&quot;, # Name of the state.
+              &quot;sessionDuration&quot;: &quot;A String&quot;, # Time spent in the state since the last reboot.
+            },
+          ],
+          &quot;currentScalingFrequencyKhz&quot;: 42, # Current frequency the CPU is running at.
+          &quot;idleDuration&quot;: &quot;A String&quot;, # Idle time since last boot.
+          &quot;maxScalingFrequencyKhz&quot;: 42, # Maximum frequency the CPU is allowed to run at, by policy.
+        },
+      ],
+      &quot;maxClockSpeedKhz&quot;: 42, # The max CPU clock speed in kHz.
+      &quot;model&quot;: &quot;A String&quot;, # The CPU model name.
+    },
+  ],
   &quot;cpuStatusReports&quot;: [ # Reports of CPU utilization and temperature (Read-only)
     {
       &quot;cpuTemperatureInfo&quot;: [ # List of CPU temperature samples.
@@ -301,6 +321,26 @@
       &quot;annotatedUser&quot;: &quot;A String&quot;, # The user of the device as noted by the administrator. Maximum length is 100 characters. Empty values are allowed.
       &quot;autoUpdateExpiration&quot;: &quot;A String&quot;, # (Read-only) The timestamp after which the device will stop receiving Chrome updates or support
       &quot;bootMode&quot;: &quot;A String&quot;, # The boot mode for the device. The possible values are: * `Verified`: The device is running a valid version of the Chrome OS. * `Dev`: The devices&#x27;s developer hardware switch is enabled. When booted, the device has a command line shell. For an example of a developer switch, see the [Chromebook developer information](https://www.chromium.org/chromium-os/developer-information-for-chrome-os-devices/samsung-series-5-chromebook#TOC-Developer-switch).
+      &quot;cpuInfo&quot;: [ # Information regarding CPU specs in the device.
+        { # CPU specs for a CPU.
+          &quot;architecture&quot;: &quot;A String&quot;, # The CPU architecture.
+          &quot;logicalCpus&quot;: [ # Information for the Logical CPUs
+            { # Status of a single logical CPU.
+              &quot;cStates&quot;: [ # C-States indicate the power consumption state of the CPU. For more information look at documentation published by the CPU maker.
+                { # Status of a single C-state. C-states are various modes the CPU can transition to in order to use more or less power.
+                  &quot;displayName&quot;: &quot;A String&quot;, # Name of the state.
+                  &quot;sessionDuration&quot;: &quot;A String&quot;, # Time spent in the state since the last reboot.
+                },
+              ],
+              &quot;currentScalingFrequencyKhz&quot;: 42, # Current frequency the CPU is running at.
+              &quot;idleDuration&quot;: &quot;A String&quot;, # Idle time since last boot.
+              &quot;maxScalingFrequencyKhz&quot;: 42, # Maximum frequency the CPU is allowed to run at, by policy.
+            },
+          ],
+          &quot;maxClockSpeedKhz&quot;: 42, # The max CPU clock speed in kHz.
+          &quot;model&quot;: &quot;A String&quot;, # The CPU model name.
+        },
+      ],
       &quot;cpuStatusReports&quot;: [ # Reports of CPU utilization and temperature (Read-only)
         {
           &quot;cpuTemperatureInfo&quot;: [ # List of CPU temperature samples.
@@ -460,6 +500,26 @@
   &quot;annotatedUser&quot;: &quot;A String&quot;, # The user of the device as noted by the administrator. Maximum length is 100 characters. Empty values are allowed.
   &quot;autoUpdateExpiration&quot;: &quot;A String&quot;, # (Read-only) The timestamp after which the device will stop receiving Chrome updates or support
   &quot;bootMode&quot;: &quot;A String&quot;, # The boot mode for the device. The possible values are: * `Verified`: The device is running a valid version of the Chrome OS. * `Dev`: The devices&#x27;s developer hardware switch is enabled. When booted, the device has a command line shell. For an example of a developer switch, see the [Chromebook developer information](https://www.chromium.org/chromium-os/developer-information-for-chrome-os-devices/samsung-series-5-chromebook#TOC-Developer-switch).
+  &quot;cpuInfo&quot;: [ # Information regarding CPU specs in the device.
+    { # CPU specs for a CPU.
+      &quot;architecture&quot;: &quot;A String&quot;, # The CPU architecture.
+      &quot;logicalCpus&quot;: [ # Information for the Logical CPUs
+        { # Status of a single logical CPU.
+          &quot;cStates&quot;: [ # C-States indicate the power consumption state of the CPU. For more information look at documentation published by the CPU maker.
+            { # Status of a single C-state. C-states are various modes the CPU can transition to in order to use more or less power.
+              &quot;displayName&quot;: &quot;A String&quot;, # Name of the state.
+              &quot;sessionDuration&quot;: &quot;A String&quot;, # Time spent in the state since the last reboot.
+            },
+          ],
+          &quot;currentScalingFrequencyKhz&quot;: 42, # Current frequency the CPU is running at.
+          &quot;idleDuration&quot;: &quot;A String&quot;, # Idle time since last boot.
+          &quot;maxScalingFrequencyKhz&quot;: 42, # Maximum frequency the CPU is allowed to run at, by policy.
+        },
+      ],
+      &quot;maxClockSpeedKhz&quot;: 42, # The max CPU clock speed in kHz.
+      &quot;model&quot;: &quot;A String&quot;, # The CPU model name.
+    },
+  ],
   &quot;cpuStatusReports&quot;: [ # Reports of CPU utilization and temperature (Read-only)
     {
       &quot;cpuTemperatureInfo&quot;: [ # List of CPU temperature samples.
@@ -578,6 +638,26 @@
   &quot;annotatedUser&quot;: &quot;A String&quot;, # The user of the device as noted by the administrator. Maximum length is 100 characters. Empty values are allowed.
   &quot;autoUpdateExpiration&quot;: &quot;A String&quot;, # (Read-only) The timestamp after which the device will stop receiving Chrome updates or support
   &quot;bootMode&quot;: &quot;A String&quot;, # The boot mode for the device. The possible values are: * `Verified`: The device is running a valid version of the Chrome OS. * `Dev`: The devices&#x27;s developer hardware switch is enabled. When booted, the device has a command line shell. For an example of a developer switch, see the [Chromebook developer information](https://www.chromium.org/chromium-os/developer-information-for-chrome-os-devices/samsung-series-5-chromebook#TOC-Developer-switch).
+  &quot;cpuInfo&quot;: [ # Information regarding CPU specs in the device.
+    { # CPU specs for a CPU.
+      &quot;architecture&quot;: &quot;A String&quot;, # The CPU architecture.
+      &quot;logicalCpus&quot;: [ # Information for the Logical CPUs
+        { # Status of a single logical CPU.
+          &quot;cStates&quot;: [ # C-States indicate the power consumption state of the CPU. For more information look at documentation published by the CPU maker.
+            { # Status of a single C-state. C-states are various modes the CPU can transition to in order to use more or less power.
+              &quot;displayName&quot;: &quot;A String&quot;, # Name of the state.
+              &quot;sessionDuration&quot;: &quot;A String&quot;, # Time spent in the state since the last reboot.
+            },
+          ],
+          &quot;currentScalingFrequencyKhz&quot;: 42, # Current frequency the CPU is running at.
+          &quot;idleDuration&quot;: &quot;A String&quot;, # Idle time since last boot.
+          &quot;maxScalingFrequencyKhz&quot;: 42, # Maximum frequency the CPU is allowed to run at, by policy.
+        },
+      ],
+      &quot;maxClockSpeedKhz&quot;: 42, # The max CPU clock speed in kHz.
+      &quot;model&quot;: &quot;A String&quot;, # The CPU model name.
+    },
+  ],
   &quot;cpuStatusReports&quot;: [ # Reports of CPU utilization and temperature (Read-only)
     {
       &quot;cpuTemperatureInfo&quot;: [ # List of CPU temperature samples.
@@ -695,6 +775,26 @@
   &quot;annotatedUser&quot;: &quot;A String&quot;, # The user of the device as noted by the administrator. Maximum length is 100 characters. Empty values are allowed.
   &quot;autoUpdateExpiration&quot;: &quot;A String&quot;, # (Read-only) The timestamp after which the device will stop receiving Chrome updates or support
   &quot;bootMode&quot;: &quot;A String&quot;, # The boot mode for the device. The possible values are: * `Verified`: The device is running a valid version of the Chrome OS. * `Dev`: The devices&#x27;s developer hardware switch is enabled. When booted, the device has a command line shell. For an example of a developer switch, see the [Chromebook developer information](https://www.chromium.org/chromium-os/developer-information-for-chrome-os-devices/samsung-series-5-chromebook#TOC-Developer-switch).
+  &quot;cpuInfo&quot;: [ # Information regarding CPU specs in the device.
+    { # CPU specs for a CPU.
+      &quot;architecture&quot;: &quot;A String&quot;, # The CPU architecture.
+      &quot;logicalCpus&quot;: [ # Information for the Logical CPUs
+        { # Status of a single logical CPU.
+          &quot;cStates&quot;: [ # C-States indicate the power consumption state of the CPU. For more information look at documentation published by the CPU maker.
+            { # Status of a single C-state. C-states are various modes the CPU can transition to in order to use more or less power.
+              &quot;displayName&quot;: &quot;A String&quot;, # Name of the state.
+              &quot;sessionDuration&quot;: &quot;A String&quot;, # Time spent in the state since the last reboot.
+            },
+          ],
+          &quot;currentScalingFrequencyKhz&quot;: 42, # Current frequency the CPU is running at.
+          &quot;idleDuration&quot;: &quot;A String&quot;, # Idle time since last boot.
+          &quot;maxScalingFrequencyKhz&quot;: 42, # Maximum frequency the CPU is allowed to run at, by policy.
+        },
+      ],
+      &quot;maxClockSpeedKhz&quot;: 42, # The max CPU clock speed in kHz.
+      &quot;model&quot;: &quot;A String&quot;, # The CPU model name.
+    },
+  ],
   &quot;cpuStatusReports&quot;: [ # Reports of CPU utilization and temperature (Read-only)
     {
       &quot;cpuTemperatureInfo&quot;: [ # List of CPU temperature samples.
@@ -813,6 +913,26 @@
   &quot;annotatedUser&quot;: &quot;A String&quot;, # The user of the device as noted by the administrator. Maximum length is 100 characters. Empty values are allowed.
   &quot;autoUpdateExpiration&quot;: &quot;A String&quot;, # (Read-only) The timestamp after which the device will stop receiving Chrome updates or support
   &quot;bootMode&quot;: &quot;A String&quot;, # The boot mode for the device. The possible values are: * `Verified`: The device is running a valid version of the Chrome OS. * `Dev`: The devices&#x27;s developer hardware switch is enabled. When booted, the device has a command line shell. For an example of a developer switch, see the [Chromebook developer information](https://www.chromium.org/chromium-os/developer-information-for-chrome-os-devices/samsung-series-5-chromebook#TOC-Developer-switch).
+  &quot;cpuInfo&quot;: [ # Information regarding CPU specs in the device.
+    { # CPU specs for a CPU.
+      &quot;architecture&quot;: &quot;A String&quot;, # The CPU architecture.
+      &quot;logicalCpus&quot;: [ # Information for the Logical CPUs
+        { # Status of a single logical CPU.
+          &quot;cStates&quot;: [ # C-States indicate the power consumption state of the CPU. For more information look at documentation published by the CPU maker.
+            { # Status of a single C-state. C-states are various modes the CPU can transition to in order to use more or less power.
+              &quot;displayName&quot;: &quot;A String&quot;, # Name of the state.
+              &quot;sessionDuration&quot;: &quot;A String&quot;, # Time spent in the state since the last reboot.
+            },
+          ],
+          &quot;currentScalingFrequencyKhz&quot;: 42, # Current frequency the CPU is running at.
+          &quot;idleDuration&quot;: &quot;A String&quot;, # Idle time since last boot.
+          &quot;maxScalingFrequencyKhz&quot;: 42, # Maximum frequency the CPU is allowed to run at, by policy.
+        },
+      ],
+      &quot;maxClockSpeedKhz&quot;: 42, # The max CPU clock speed in kHz.
+      &quot;model&quot;: &quot;A String&quot;, # The CPU model name.
+    },
+  ],
   &quot;cpuStatusReports&quot;: [ # Reports of CPU utilization and temperature (Read-only)
     {
       &quot;cpuTemperatureInfo&quot;: [ # List of CPU temperature samples.
diff --git a/docs/dyn/admin_directory_v1.schemas.html b/docs/dyn/admin_directory_v1.schemas.html
index b4f8425..ac99a2e 100644
--- a/docs/dyn/admin_directory_v1.schemas.html
+++ b/docs/dyn/admin_directory_v1.schemas.html
@@ -152,7 +152,7 @@
   ],
   &quot;kind&quot;: &quot;admin#directory#schema&quot;, # Kind of resource this is.
   &quot;schemaId&quot;: &quot;A String&quot;, # The unique identifier of the schema (Read-only)
-  &quot;schemaName&quot;: &quot;A String&quot;, # The schema&#x27;s name.
+  &quot;schemaName&quot;: &quot;A String&quot;, # The schema&#x27;s name. Each `schema_name` must be unique within a customer. Reusing a name results in a `409: Entity already exists` error.
 }</pre>
 </div>
 
@@ -187,7 +187,7 @@
   ],
   &quot;kind&quot;: &quot;admin#directory#schema&quot;, # Kind of resource this is.
   &quot;schemaId&quot;: &quot;A String&quot;, # The unique identifier of the schema (Read-only)
-  &quot;schemaName&quot;: &quot;A String&quot;, # The schema&#x27;s name.
+  &quot;schemaName&quot;: &quot;A String&quot;, # The schema&#x27;s name. Each `schema_name` must be unique within a customer. Reusing a name results in a `409: Entity already exists` error.
 }
 
   x__xgafv: string, V1 error format.
@@ -220,7 +220,7 @@
   ],
   &quot;kind&quot;: &quot;admin#directory#schema&quot;, # Kind of resource this is.
   &quot;schemaId&quot;: &quot;A String&quot;, # The unique identifier of the schema (Read-only)
-  &quot;schemaName&quot;: &quot;A String&quot;, # The schema&#x27;s name.
+  &quot;schemaName&quot;: &quot;A String&quot;, # The schema&#x27;s name. Each `schema_name` must be unique within a customer. Reusing a name results in a `409: Entity already exists` error.
 }</pre>
 </div>
 
@@ -264,7 +264,7 @@
       ],
       &quot;kind&quot;: &quot;admin#directory#schema&quot;, # Kind of resource this is.
       &quot;schemaId&quot;: &quot;A String&quot;, # The unique identifier of the schema (Read-only)
-      &quot;schemaName&quot;: &quot;A String&quot;, # The schema&#x27;s name.
+      &quot;schemaName&quot;: &quot;A String&quot;, # The schema&#x27;s name. Each `schema_name` must be unique within a customer. Reusing a name results in a `409: Entity already exists` error.
     },
   ],
 }</pre>
@@ -302,7 +302,7 @@
   ],
   &quot;kind&quot;: &quot;admin#directory#schema&quot;, # Kind of resource this is.
   &quot;schemaId&quot;: &quot;A String&quot;, # The unique identifier of the schema (Read-only)
-  &quot;schemaName&quot;: &quot;A String&quot;, # The schema&#x27;s name.
+  &quot;schemaName&quot;: &quot;A String&quot;, # The schema&#x27;s name. Each `schema_name` must be unique within a customer. Reusing a name results in a `409: Entity already exists` error.
 }
 
   x__xgafv: string, V1 error format.
@@ -335,7 +335,7 @@
   ],
   &quot;kind&quot;: &quot;admin#directory#schema&quot;, # Kind of resource this is.
   &quot;schemaId&quot;: &quot;A String&quot;, # The unique identifier of the schema (Read-only)
-  &quot;schemaName&quot;: &quot;A String&quot;, # The schema&#x27;s name.
+  &quot;schemaName&quot;: &quot;A String&quot;, # The schema&#x27;s name. Each `schema_name` must be unique within a customer. Reusing a name results in a `409: Entity already exists` error.
 }</pre>
 </div>
 
@@ -371,7 +371,7 @@
   ],
   &quot;kind&quot;: &quot;admin#directory#schema&quot;, # Kind of resource this is.
   &quot;schemaId&quot;: &quot;A String&quot;, # The unique identifier of the schema (Read-only)
-  &quot;schemaName&quot;: &quot;A String&quot;, # The schema&#x27;s name.
+  &quot;schemaName&quot;: &quot;A String&quot;, # The schema&#x27;s name. Each `schema_name` must be unique within a customer. Reusing a name results in a `409: Entity already exists` error.
 }
 
   x__xgafv: string, V1 error format.
@@ -404,7 +404,7 @@
   ],
   &quot;kind&quot;: &quot;admin#directory#schema&quot;, # Kind of resource this is.
   &quot;schemaId&quot;: &quot;A String&quot;, # The unique identifier of the schema (Read-only)
-  &quot;schemaName&quot;: &quot;A String&quot;, # The schema&#x27;s name.
+  &quot;schemaName&quot;: &quot;A String&quot;, # The schema&#x27;s name. Each `schema_name` must be unique within a customer. Reusing a name results in a `409: Entity already exists` error.
 }</pre>
 </div>
 
diff --git a/docs/dyn/admin_directory_v1.users.html b/docs/dyn/admin_directory_v1.users.html
index 481edf6..0087802 100644
--- a/docs/dyn/admin_directory_v1.users.html
+++ b/docs/dyn/admin_directory_v1.users.html
@@ -172,7 +172,7 @@
   &quot;archived&quot;: True or False, # Indicates if user is archived.
   &quot;changePasswordAtNextLogin&quot;: True or False, # Indicates if the user is forced to change their password at next login. This setting doesn&#x27;t apply when [the user signs in via a third-party identity provider](https://support.google.com/a/answer/60224).
   &quot;creationTime&quot;: &quot;A String&quot;, # User&#x27;s G Suite account creation time. (Read-only)
-  &quot;customSchemas&quot;: { # Custom fields of the user.
+  &quot;customSchemas&quot;: { # Custom fields of the user. The key is a `schema_name` and its values are `&#x27;field_name&#x27;: &#x27;field_value&#x27;`.
     &quot;a_key&quot;: { # JSON template for a set of custom properties (i.e. all fields in a particular schema)
       &quot;a_key&quot;: &quot;&quot;,
     },
@@ -242,7 +242,7 @@
   &quot;archived&quot;: True or False, # Indicates if user is archived.
   &quot;changePasswordAtNextLogin&quot;: True or False, # Indicates if the user is forced to change their password at next login. This setting doesn&#x27;t apply when [the user signs in via a third-party identity provider](https://support.google.com/a/answer/60224).
   &quot;creationTime&quot;: &quot;A String&quot;, # User&#x27;s G Suite account creation time. (Read-only)
-  &quot;customSchemas&quot;: { # Custom fields of the user.
+  &quot;customSchemas&quot;: { # Custom fields of the user. The key is a `schema_name` and its values are `&#x27;field_name&#x27;: &#x27;field_value&#x27;`.
     &quot;a_key&quot;: { # JSON template for a set of custom properties (i.e. all fields in a particular schema)
       &quot;a_key&quot;: &quot;&quot;,
     },
@@ -311,7 +311,7 @@
   &quot;archived&quot;: True or False, # Indicates if user is archived.
   &quot;changePasswordAtNextLogin&quot;: True or False, # Indicates if the user is forced to change their password at next login. This setting doesn&#x27;t apply when [the user signs in via a third-party identity provider](https://support.google.com/a/answer/60224).
   &quot;creationTime&quot;: &quot;A String&quot;, # User&#x27;s G Suite account creation time. (Read-only)
-  &quot;customSchemas&quot;: { # Custom fields of the user.
+  &quot;customSchemas&quot;: { # Custom fields of the user. The key is a `schema_name` and its values are `&#x27;field_name&#x27;: &#x27;field_value&#x27;`.
     &quot;a_key&quot;: { # JSON template for a set of custom properties (i.e. all fields in a particular schema)
       &quot;a_key&quot;: &quot;&quot;,
     },
@@ -424,7 +424,7 @@
       &quot;archived&quot;: True or False, # Indicates if user is archived.
       &quot;changePasswordAtNextLogin&quot;: True or False, # Indicates if the user is forced to change their password at next login. This setting doesn&#x27;t apply when [the user signs in via a third-party identity provider](https://support.google.com/a/answer/60224).
       &quot;creationTime&quot;: &quot;A String&quot;, # User&#x27;s G Suite account creation time. (Read-only)
-      &quot;customSchemas&quot;: { # Custom fields of the user.
+      &quot;customSchemas&quot;: { # Custom fields of the user. The key is a `schema_name` and its values are `&#x27;field_name&#x27;: &#x27;field_value&#x27;`.
         &quot;a_key&quot;: { # JSON template for a set of custom properties (i.e. all fields in a particular schema)
           &quot;a_key&quot;: &quot;&quot;,
         },
@@ -531,7 +531,7 @@
   &quot;archived&quot;: True or False, # Indicates if user is archived.
   &quot;changePasswordAtNextLogin&quot;: True or False, # Indicates if the user is forced to change their password at next login. This setting doesn&#x27;t apply when [the user signs in via a third-party identity provider](https://support.google.com/a/answer/60224).
   &quot;creationTime&quot;: &quot;A String&quot;, # User&#x27;s G Suite account creation time. (Read-only)
-  &quot;customSchemas&quot;: { # Custom fields of the user.
+  &quot;customSchemas&quot;: { # Custom fields of the user. The key is a `schema_name` and its values are `&#x27;field_name&#x27;: &#x27;field_value&#x27;`.
     &quot;a_key&quot;: { # JSON template for a set of custom properties (i.e. all fields in a particular schema)
       &quot;a_key&quot;: &quot;&quot;,
     },
@@ -600,7 +600,7 @@
   &quot;archived&quot;: True or False, # Indicates if user is archived.
   &quot;changePasswordAtNextLogin&quot;: True or False, # Indicates if the user is forced to change their password at next login. This setting doesn&#x27;t apply when [the user signs in via a third-party identity provider](https://support.google.com/a/answer/60224).
   &quot;creationTime&quot;: &quot;A String&quot;, # User&#x27;s G Suite account creation time. (Read-only)
-  &quot;customSchemas&quot;: { # Custom fields of the user.
+  &quot;customSchemas&quot;: { # Custom fields of the user. The key is a `schema_name` and its values are `&#x27;field_name&#x27;: &#x27;field_value&#x27;`.
     &quot;a_key&quot;: { # JSON template for a set of custom properties (i.e. all fields in a particular schema)
       &quot;a_key&quot;: &quot;&quot;,
     },
@@ -704,7 +704,7 @@
   &quot;archived&quot;: True or False, # Indicates if user is archived.
   &quot;changePasswordAtNextLogin&quot;: True or False, # Indicates if the user is forced to change their password at next login. This setting doesn&#x27;t apply when [the user signs in via a third-party identity provider](https://support.google.com/a/answer/60224).
   &quot;creationTime&quot;: &quot;A String&quot;, # User&#x27;s G Suite account creation time. (Read-only)
-  &quot;customSchemas&quot;: { # Custom fields of the user.
+  &quot;customSchemas&quot;: { # Custom fields of the user. The key is a `schema_name` and its values are `&#x27;field_name&#x27;: &#x27;field_value&#x27;`.
     &quot;a_key&quot;: { # JSON template for a set of custom properties (i.e. all fields in a particular schema)
       &quot;a_key&quot;: &quot;&quot;,
     },
@@ -773,7 +773,7 @@
   &quot;archived&quot;: True or False, # Indicates if user is archived.
   &quot;changePasswordAtNextLogin&quot;: True or False, # Indicates if the user is forced to change their password at next login. This setting doesn&#x27;t apply when [the user signs in via a third-party identity provider](https://support.google.com/a/answer/60224).
   &quot;creationTime&quot;: &quot;A String&quot;, # User&#x27;s G Suite account creation time. (Read-only)
-  &quot;customSchemas&quot;: { # Custom fields of the user.
+  &quot;customSchemas&quot;: { # Custom fields of the user. The key is a `schema_name` and its values are `&#x27;field_name&#x27;: &#x27;field_value&#x27;`.
     &quot;a_key&quot;: { # JSON template for a set of custom properties (i.e. all fields in a particular schema)
       &quot;a_key&quot;: &quot;&quot;,
     },
diff --git a/docs/dyn/analyticsadmin_v1alpha.accounts.userLinks.html b/docs/dyn/analyticsadmin_v1alpha.accounts.userLinks.html
index 7fcaf9d..543bc13 100644
--- a/docs/dyn/analyticsadmin_v1alpha.accounts.userLinks.html
+++ b/docs/dyn/analyticsadmin_v1alpha.accounts.userLinks.html
@@ -140,10 +140,10 @@
   &quot;nextPageToken&quot;: &quot;A String&quot;, # A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
   &quot;userLinks&quot;: [ # List of AuditUserLinks. These will be ordered stably, but in an arbitrary order.
     { # Read-only resource used to summarize a principal&#x27;s effective roles.
-      &quot;directRoles&quot;: [ # Roles directly assigned to this user for this entity. Format: predefinedRoles/read Excludes roles that are inherited from an account (if this is for a property), group, or organization admin role.
+      &quot;directRoles&quot;: [ # Roles directly assigned to this user for this entity. Format: predefinedRoles/viewer Excludes roles that are inherited from an account (if this is for a property), group, or organization admin role.
         &quot;A String&quot;,
       ],
-      &quot;effectiveRoles&quot;: [ # Union of all permissions a user has at this account or property (includes direct permissions, group-inherited permissions, etc.). Format: predefinedRoles/read
+      &quot;effectiveRoles&quot;: [ # Union of all permissions a user has at this account or property (includes direct permissions, group-inherited permissions, etc.). Format: predefinedRoles/viewer
         &quot;A String&quot;,
       ],
       &quot;emailAddress&quot;: &quot;A String&quot;, # Email address of the linked user
@@ -183,7 +183,7 @@
       &quot;notifyNewUser&quot;: True or False, # Optional. If set, then email the new user notifying them that they&#x27;ve been granted permissions to the resource.
       &quot;parent&quot;: &quot;A String&quot;, # Required. Example format: accounts/1234
       &quot;userLink&quot;: { # A resource message representing a user&#x27;s permissions on an Account or Property resource. # Required. The user link to create.
-        &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/read predefinedRoles/collaborate predefinedRoles/edit predefinedRoles/admin Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
+        &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/viewer predefinedRoles/analyst predefinedRoles/editor predefinedRoles/admin predefinedRoles/no-cost-data predefinedRoles/no-revenue-data Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
           &quot;A String&quot;,
         ],
         &quot;emailAddress&quot;: &quot;A String&quot;, # Immutable. Email address of the user to link
@@ -204,7 +204,7 @@
     { # Response message for BatchCreateUserLinks RPC.
   &quot;userLinks&quot;: [ # The user links created.
     { # A resource message representing a user&#x27;s permissions on an Account or Property resource.
-      &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/read predefinedRoles/collaborate predefinedRoles/edit predefinedRoles/admin Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
+      &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/viewer predefinedRoles/analyst predefinedRoles/editor predefinedRoles/admin predefinedRoles/no-cost-data predefinedRoles/no-revenue-data Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
         &quot;A String&quot;,
       ],
       &quot;emailAddress&quot;: &quot;A String&quot;, # Immutable. Email address of the user to link
@@ -261,7 +261,7 @@
     { # Response message for BatchGetUserLinks RPC.
   &quot;userLinks&quot;: [ # The requested user links.
     { # A resource message representing a user&#x27;s permissions on an Account or Property resource.
-      &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/read predefinedRoles/collaborate predefinedRoles/edit predefinedRoles/admin Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
+      &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/viewer predefinedRoles/analyst predefinedRoles/editor predefinedRoles/admin predefinedRoles/no-cost-data predefinedRoles/no-revenue-data Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
         &quot;A String&quot;,
       ],
       &quot;emailAddress&quot;: &quot;A String&quot;, # Immutable. Email address of the user to link
@@ -284,7 +284,7 @@
   &quot;requests&quot;: [ # Required. The requests specifying the user links to update. A maximum of 1000 user links can be updated in a batch.
     { # Request message for UpdateUserLink RPC.
       &quot;userLink&quot;: { # A resource message representing a user&#x27;s permissions on an Account or Property resource. # Required. The user link to update.
-        &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/read predefinedRoles/collaborate predefinedRoles/edit predefinedRoles/admin Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
+        &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/viewer predefinedRoles/analyst predefinedRoles/editor predefinedRoles/admin predefinedRoles/no-cost-data predefinedRoles/no-revenue-data Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
           &quot;A String&quot;,
         ],
         &quot;emailAddress&quot;: &quot;A String&quot;, # Immutable. Email address of the user to link
@@ -305,7 +305,7 @@
     { # Response message for BatchUpdateUserLinks RPC.
   &quot;userLinks&quot;: [ # The user links updated.
     { # A resource message representing a user&#x27;s permissions on an Account or Property resource.
-      &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/read predefinedRoles/collaborate predefinedRoles/edit predefinedRoles/admin Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
+      &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/viewer predefinedRoles/analyst predefinedRoles/editor predefinedRoles/admin predefinedRoles/no-cost-data predefinedRoles/no-revenue-data Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
         &quot;A String&quot;,
       ],
       &quot;emailAddress&quot;: &quot;A String&quot;, # Immutable. Email address of the user to link
@@ -330,7 +330,7 @@
     The object takes the form of:
 
 { # A resource message representing a user&#x27;s permissions on an Account or Property resource.
-  &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/read predefinedRoles/collaborate predefinedRoles/edit predefinedRoles/admin Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
+  &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/viewer predefinedRoles/analyst predefinedRoles/editor predefinedRoles/admin predefinedRoles/no-cost-data predefinedRoles/no-revenue-data Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
     &quot;A String&quot;,
   ],
   &quot;emailAddress&quot;: &quot;A String&quot;, # Immutable. Email address of the user to link
@@ -347,7 +347,7 @@
   An object of the form:
 
     { # A resource message representing a user&#x27;s permissions on an Account or Property resource.
-  &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/read predefinedRoles/collaborate predefinedRoles/edit predefinedRoles/admin Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
+  &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/viewer predefinedRoles/analyst predefinedRoles/editor predefinedRoles/admin predefinedRoles/no-cost-data predefinedRoles/no-revenue-data Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
     &quot;A String&quot;,
   ],
   &quot;emailAddress&quot;: &quot;A String&quot;, # Immutable. Email address of the user to link
@@ -388,7 +388,7 @@
   An object of the form:
 
     { # A resource message representing a user&#x27;s permissions on an Account or Property resource.
-  &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/read predefinedRoles/collaborate predefinedRoles/edit predefinedRoles/admin Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
+  &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/viewer predefinedRoles/analyst predefinedRoles/editor predefinedRoles/admin predefinedRoles/no-cost-data predefinedRoles/no-revenue-data Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
     &quot;A String&quot;,
   ],
   &quot;emailAddress&quot;: &quot;A String&quot;, # Immutable. Email address of the user to link
@@ -416,7 +416,7 @@
   &quot;nextPageToken&quot;: &quot;A String&quot;, # A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
   &quot;userLinks&quot;: [ # List of UserLinks. These will be ordered stably, but in an arbitrary order.
     { # A resource message representing a user&#x27;s permissions on an Account or Property resource.
-      &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/read predefinedRoles/collaborate predefinedRoles/edit predefinedRoles/admin Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
+      &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/viewer predefinedRoles/analyst predefinedRoles/editor predefinedRoles/admin predefinedRoles/no-cost-data predefinedRoles/no-revenue-data Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
         &quot;A String&quot;,
       ],
       &quot;emailAddress&quot;: &quot;A String&quot;, # Immutable. Email address of the user to link
@@ -450,7 +450,7 @@
     The object takes the form of:
 
 { # A resource message representing a user&#x27;s permissions on an Account or Property resource.
-  &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/read predefinedRoles/collaborate predefinedRoles/edit predefinedRoles/admin Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
+  &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/viewer predefinedRoles/analyst predefinedRoles/editor predefinedRoles/admin predefinedRoles/no-cost-data predefinedRoles/no-revenue-data Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
     &quot;A String&quot;,
   ],
   &quot;emailAddress&quot;: &quot;A String&quot;, # Immutable. Email address of the user to link
@@ -466,7 +466,7 @@
   An object of the form:
 
     { # A resource message representing a user&#x27;s permissions on an Account or Property resource.
-  &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/read predefinedRoles/collaborate predefinedRoles/edit predefinedRoles/admin Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
+  &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/viewer predefinedRoles/analyst predefinedRoles/editor predefinedRoles/admin predefinedRoles/no-cost-data predefinedRoles/no-revenue-data Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
     &quot;A String&quot;,
   ],
   &quot;emailAddress&quot;: &quot;A String&quot;, # Immutable. Email address of the user to link
diff --git a/docs/dyn/analyticsadmin_v1alpha.properties.userLinks.html b/docs/dyn/analyticsadmin_v1alpha.properties.userLinks.html
index d132fbb..51f498a 100644
--- a/docs/dyn/analyticsadmin_v1alpha.properties.userLinks.html
+++ b/docs/dyn/analyticsadmin_v1alpha.properties.userLinks.html
@@ -140,10 +140,10 @@
   &quot;nextPageToken&quot;: &quot;A String&quot;, # A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
   &quot;userLinks&quot;: [ # List of AuditUserLinks. These will be ordered stably, but in an arbitrary order.
     { # Read-only resource used to summarize a principal&#x27;s effective roles.
-      &quot;directRoles&quot;: [ # Roles directly assigned to this user for this entity. Format: predefinedRoles/read Excludes roles that are inherited from an account (if this is for a property), group, or organization admin role.
+      &quot;directRoles&quot;: [ # Roles directly assigned to this user for this entity. Format: predefinedRoles/viewer Excludes roles that are inherited from an account (if this is for a property), group, or organization admin role.
         &quot;A String&quot;,
       ],
-      &quot;effectiveRoles&quot;: [ # Union of all permissions a user has at this account or property (includes direct permissions, group-inherited permissions, etc.). Format: predefinedRoles/read
+      &quot;effectiveRoles&quot;: [ # Union of all permissions a user has at this account or property (includes direct permissions, group-inherited permissions, etc.). Format: predefinedRoles/viewer
         &quot;A String&quot;,
       ],
       &quot;emailAddress&quot;: &quot;A String&quot;, # Email address of the linked user
@@ -183,7 +183,7 @@
       &quot;notifyNewUser&quot;: True or False, # Optional. If set, then email the new user notifying them that they&#x27;ve been granted permissions to the resource.
       &quot;parent&quot;: &quot;A String&quot;, # Required. Example format: accounts/1234
       &quot;userLink&quot;: { # A resource message representing a user&#x27;s permissions on an Account or Property resource. # Required. The user link to create.
-        &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/read predefinedRoles/collaborate predefinedRoles/edit predefinedRoles/admin Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
+        &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/viewer predefinedRoles/analyst predefinedRoles/editor predefinedRoles/admin predefinedRoles/no-cost-data predefinedRoles/no-revenue-data Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
           &quot;A String&quot;,
         ],
         &quot;emailAddress&quot;: &quot;A String&quot;, # Immutable. Email address of the user to link
@@ -204,7 +204,7 @@
     { # Response message for BatchCreateUserLinks RPC.
   &quot;userLinks&quot;: [ # The user links created.
     { # A resource message representing a user&#x27;s permissions on an Account or Property resource.
-      &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/read predefinedRoles/collaborate predefinedRoles/edit predefinedRoles/admin Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
+      &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/viewer predefinedRoles/analyst predefinedRoles/editor predefinedRoles/admin predefinedRoles/no-cost-data predefinedRoles/no-revenue-data Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
         &quot;A String&quot;,
       ],
       &quot;emailAddress&quot;: &quot;A String&quot;, # Immutable. Email address of the user to link
@@ -261,7 +261,7 @@
     { # Response message for BatchGetUserLinks RPC.
   &quot;userLinks&quot;: [ # The requested user links.
     { # A resource message representing a user&#x27;s permissions on an Account or Property resource.
-      &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/read predefinedRoles/collaborate predefinedRoles/edit predefinedRoles/admin Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
+      &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/viewer predefinedRoles/analyst predefinedRoles/editor predefinedRoles/admin predefinedRoles/no-cost-data predefinedRoles/no-revenue-data Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
         &quot;A String&quot;,
       ],
       &quot;emailAddress&quot;: &quot;A String&quot;, # Immutable. Email address of the user to link
@@ -284,7 +284,7 @@
   &quot;requests&quot;: [ # Required. The requests specifying the user links to update. A maximum of 1000 user links can be updated in a batch.
     { # Request message for UpdateUserLink RPC.
       &quot;userLink&quot;: { # A resource message representing a user&#x27;s permissions on an Account or Property resource. # Required. The user link to update.
-        &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/read predefinedRoles/collaborate predefinedRoles/edit predefinedRoles/admin Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
+        &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/viewer predefinedRoles/analyst predefinedRoles/editor predefinedRoles/admin predefinedRoles/no-cost-data predefinedRoles/no-revenue-data Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
           &quot;A String&quot;,
         ],
         &quot;emailAddress&quot;: &quot;A String&quot;, # Immutable. Email address of the user to link
@@ -305,7 +305,7 @@
     { # Response message for BatchUpdateUserLinks RPC.
   &quot;userLinks&quot;: [ # The user links updated.
     { # A resource message representing a user&#x27;s permissions on an Account or Property resource.
-      &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/read predefinedRoles/collaborate predefinedRoles/edit predefinedRoles/admin Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
+      &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/viewer predefinedRoles/analyst predefinedRoles/editor predefinedRoles/admin predefinedRoles/no-cost-data predefinedRoles/no-revenue-data Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
         &quot;A String&quot;,
       ],
       &quot;emailAddress&quot;: &quot;A String&quot;, # Immutable. Email address of the user to link
@@ -330,7 +330,7 @@
     The object takes the form of:
 
 { # A resource message representing a user&#x27;s permissions on an Account or Property resource.
-  &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/read predefinedRoles/collaborate predefinedRoles/edit predefinedRoles/admin Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
+  &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/viewer predefinedRoles/analyst predefinedRoles/editor predefinedRoles/admin predefinedRoles/no-cost-data predefinedRoles/no-revenue-data Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
     &quot;A String&quot;,
   ],
   &quot;emailAddress&quot;: &quot;A String&quot;, # Immutable. Email address of the user to link
@@ -347,7 +347,7 @@
   An object of the form:
 
     { # A resource message representing a user&#x27;s permissions on an Account or Property resource.
-  &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/read predefinedRoles/collaborate predefinedRoles/edit predefinedRoles/admin Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
+  &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/viewer predefinedRoles/analyst predefinedRoles/editor predefinedRoles/admin predefinedRoles/no-cost-data predefinedRoles/no-revenue-data Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
     &quot;A String&quot;,
   ],
   &quot;emailAddress&quot;: &quot;A String&quot;, # Immutable. Email address of the user to link
@@ -388,7 +388,7 @@
   An object of the form:
 
     { # A resource message representing a user&#x27;s permissions on an Account or Property resource.
-  &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/read predefinedRoles/collaborate predefinedRoles/edit predefinedRoles/admin Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
+  &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/viewer predefinedRoles/analyst predefinedRoles/editor predefinedRoles/admin predefinedRoles/no-cost-data predefinedRoles/no-revenue-data Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
     &quot;A String&quot;,
   ],
   &quot;emailAddress&quot;: &quot;A String&quot;, # Immutable. Email address of the user to link
@@ -416,7 +416,7 @@
   &quot;nextPageToken&quot;: &quot;A String&quot;, # A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
   &quot;userLinks&quot;: [ # List of UserLinks. These will be ordered stably, but in an arbitrary order.
     { # A resource message representing a user&#x27;s permissions on an Account or Property resource.
-      &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/read predefinedRoles/collaborate predefinedRoles/edit predefinedRoles/admin Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
+      &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/viewer predefinedRoles/analyst predefinedRoles/editor predefinedRoles/admin predefinedRoles/no-cost-data predefinedRoles/no-revenue-data Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
         &quot;A String&quot;,
       ],
       &quot;emailAddress&quot;: &quot;A String&quot;, # Immutable. Email address of the user to link
@@ -450,7 +450,7 @@
     The object takes the form of:
 
 { # A resource message representing a user&#x27;s permissions on an Account or Property resource.
-  &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/read predefinedRoles/collaborate predefinedRoles/edit predefinedRoles/admin Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
+  &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/viewer predefinedRoles/analyst predefinedRoles/editor predefinedRoles/admin predefinedRoles/no-cost-data predefinedRoles/no-revenue-data Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
     &quot;A String&quot;,
   ],
   &quot;emailAddress&quot;: &quot;A String&quot;, # Immutable. Email address of the user to link
@@ -466,7 +466,7 @@
   An object of the form:
 
     { # A resource message representing a user&#x27;s permissions on an Account or Property resource.
-  &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/read predefinedRoles/collaborate predefinedRoles/edit predefinedRoles/admin Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
+  &quot;directRoles&quot;: [ # Roles directly assigned to this user for this account or property. Valid values: predefinedRoles/viewer predefinedRoles/analyst predefinedRoles/editor predefinedRoles/admin predefinedRoles/no-cost-data predefinedRoles/no-revenue-data Excludes roles that are inherited from a higher-level entity, group, or organization admin role. A UserLink that is updated to have an empty list of direct_roles will be deleted.
     &quot;A String&quot;,
   ],
   &quot;emailAddress&quot;: &quot;A String&quot;, # Immutable. Email address of the user to link
diff --git a/docs/dyn/androidpublisher_v3.applications.html b/docs/dyn/androidpublisher_v3.applications.html
new file mode 100644
index 0000000..a48140b
--- /dev/null
+++ b/docs/dyn/androidpublisher_v3.applications.html
@@ -0,0 +1,91 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="androidpublisher_v3.html">Google Play Android Developer API</a> . <a href="androidpublisher_v3.applications.html">applications</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="androidpublisher_v3.applications.pricing.html">pricing()</a></code>
+</p>
+<p class="firstline">Returns the pricing Resource.</p>
+
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/androidpublisher_v3.applications.pricing.html b/docs/dyn/androidpublisher_v3.applications.pricing.html
new file mode 100644
index 0000000..99a5791
--- /dev/null
+++ b/docs/dyn/androidpublisher_v3.applications.pricing.html
@@ -0,0 +1,145 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="androidpublisher_v3.html">Google Play Android Developer API</a> . <a href="androidpublisher_v3.applications.html">applications</a> . <a href="androidpublisher_v3.applications.pricing.html">pricing</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#convertRegionPrices">convertRegionPrices(packageName, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Calculates the region prices, using today's exchange rate and country-specific pricing patterns, based on the price in the request for a set of regions.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="convertRegionPrices">convertRegionPrices(packageName, body=None, x__xgafv=None)</code>
+  <pre>Calculates the region prices, using today&#x27;s exchange rate and country-specific pricing patterns, based on the price in the request for a set of regions.
+
+Args:
+  packageName: string, Required. The app package name. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Request message for ConvertRegionPrices.
+  &quot;price&quot;: { # Represents an amount of money with its currency type. # The intital price to convert other regions from. Tax exclusive.
+    &quot;currencyCode&quot;: &quot;A String&quot;, # The three-letter currency code defined in ISO 4217.
+    &quot;nanos&quot;: 42, # Number of nano (10^-9) units of the amount. The value must be between -999,999,999 and +999,999,999 inclusive. If `units` is positive, `nanos` must be positive or zero. If `units` is zero, `nanos` can be positive, zero, or negative. If `units` is negative, `nanos` must be negative or zero. For example $-1.75 is represented as `units`=-1 and `nanos`=-750,000,000.
+    &quot;units&quot;: &quot;A String&quot;, # The whole units of the amount. For example if `currencyCode` is `&quot;USD&quot;`, then 1 unit is one US dollar.
+  },
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Response message for ConvertRegionPrices.
+  &quot;convertedOtherRegionsPrice&quot;: { # Converted other regions prices. # Converted other regions prices in USD and EUR, to use for countries where Play doesn&#x27;t support a country&#x27;s local currency.
+    &quot;eurPrice&quot;: { # Represents an amount of money with its currency type. # Price in EUR to use for the &quot;Other regions&quot; location exclusive of taxes.
+      &quot;currencyCode&quot;: &quot;A String&quot;, # The three-letter currency code defined in ISO 4217.
+      &quot;nanos&quot;: 42, # Number of nano (10^-9) units of the amount. The value must be between -999,999,999 and +999,999,999 inclusive. If `units` is positive, `nanos` must be positive or zero. If `units` is zero, `nanos` can be positive, zero, or negative. If `units` is negative, `nanos` must be negative or zero. For example $-1.75 is represented as `units`=-1 and `nanos`=-750,000,000.
+      &quot;units&quot;: &quot;A String&quot;, # The whole units of the amount. For example if `currencyCode` is `&quot;USD&quot;`, then 1 unit is one US dollar.
+    },
+    &quot;usdPrice&quot;: { # Represents an amount of money with its currency type. # Price in USD to use for the &quot;Other regions&quot; location exclusive of taxes.
+      &quot;currencyCode&quot;: &quot;A String&quot;, # The three-letter currency code defined in ISO 4217.
+      &quot;nanos&quot;: 42, # Number of nano (10^-9) units of the amount. The value must be between -999,999,999 and +999,999,999 inclusive. If `units` is positive, `nanos` must be positive or zero. If `units` is zero, `nanos` can be positive, zero, or negative. If `units` is negative, `nanos` must be negative or zero. For example $-1.75 is represented as `units`=-1 and `nanos`=-750,000,000.
+      &quot;units&quot;: &quot;A String&quot;, # The whole units of the amount. For example if `currencyCode` is `&quot;USD&quot;`, then 1 unit is one US dollar.
+    },
+  },
+  &quot;convertedRegionPrices&quot;: { # Map from region code to converted region price.
+    &quot;a_key&quot;: { # A converted region price.
+      &quot;price&quot;: { # Represents an amount of money with its currency type. # The converted price tax inclusive.
+        &quot;currencyCode&quot;: &quot;A String&quot;, # The three-letter currency code defined in ISO 4217.
+        &quot;nanos&quot;: 42, # Number of nano (10^-9) units of the amount. The value must be between -999,999,999 and +999,999,999 inclusive. If `units` is positive, `nanos` must be positive or zero. If `units` is zero, `nanos` can be positive, zero, or negative. If `units` is negative, `nanos` must be negative or zero. For example $-1.75 is represented as `units`=-1 and `nanos`=-750,000,000.
+        &quot;units&quot;: &quot;A String&quot;, # The whole units of the amount. For example if `currencyCode` is `&quot;USD&quot;`, then 1 unit is one US dollar.
+      },
+      &quot;regionCode&quot;: &quot;A String&quot;, # The region code of the region.
+      &quot;taxAmount&quot;: { # Represents an amount of money with its currency type. # The tax amount of the converted price.
+        &quot;currencyCode&quot;: &quot;A String&quot;, # The three-letter currency code defined in ISO 4217.
+        &quot;nanos&quot;: 42, # Number of nano (10^-9) units of the amount. The value must be between -999,999,999 and +999,999,999 inclusive. If `units` is positive, `nanos` must be positive or zero. If `units` is zero, `nanos` can be positive, zero, or negative. If `units` is negative, `nanos` must be negative or zero. For example $-1.75 is represented as `units`=-1 and `nanos`=-750,000,000.
+        &quot;units&quot;: &quot;A String&quot;, # The whole units of the amount. For example if `currencyCode` is `&quot;USD&quot;`, then 1 unit is one US dollar.
+      },
+    },
+  },
+}</pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/androidpublisher_v3.html b/docs/dyn/androidpublisher_v3.html
index 4a3c59a..7370d94 100644
--- a/docs/dyn/androidpublisher_v3.html
+++ b/docs/dyn/androidpublisher_v3.html
@@ -75,6 +75,11 @@
 <h1><a href="androidpublisher_v3.html">Google Play Android Developer API</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
+  <code><a href="androidpublisher_v3.applications.html">applications()</a></code>
+</p>
+<p class="firstline">Returns the applications Resource.</p>
+
+<p class="toc_element">
   <code><a href="androidpublisher_v3.edits.html">edits()</a></code>
 </p>
 <p class="firstline">Returns the edits Resource.</p>
diff --git a/docs/dyn/apigee_v1.organizations.html b/docs/dyn/apigee_v1.organizations.html
index 4edbf73..5ca3e9d 100644
--- a/docs/dyn/apigee_v1.organizations.html
+++ b/docs/dyn/apigee_v1.organizations.html
@@ -216,6 +216,13 @@
     &quot;advancedApiOpsConfig&quot;: { # Configuration for the Advanced API Ops add-on. # Configuration for the Advanced API Ops add-on.
       &quot;enabled&quot;: True or False, # Flag that specifies whether the Advanced API Ops add-on is enabled.
     },
+    &quot;connectorsPlatformConfig&quot;: { # Configuration for the Connectors Platform add-on. # Configuration for the Connectors Platform add-on.
+      &quot;enabled&quot;: True or False, # Flag that specifies whether the Connectors Platform add-on is enabled.
+      &quot;expiresAt&quot;: &quot;A String&quot;, # Output only. Time at which the Connectors Platform add-on expires in in milliseconds since epoch. If unspecified, the add-on will never expire.
+    },
+    &quot;integrationConfig&quot;: { # Configuration for the Integration add-on. # Configuration for the Integration add-on.
+      &quot;enabled&quot;: True or False, # Flag that specifies whether the Integration add-on is enabled.
+    },
     &quot;monetizationConfig&quot;: { # Configuration for the Monetization add-on. # Configuration for the Monetization add-on.
       &quot;enabled&quot;: True or False, # Flag that specifies whether the Monetization add-on is enabled.
     },
@@ -337,6 +344,13 @@
     &quot;advancedApiOpsConfig&quot;: { # Configuration for the Advanced API Ops add-on. # Configuration for the Advanced API Ops add-on.
       &quot;enabled&quot;: True or False, # Flag that specifies whether the Advanced API Ops add-on is enabled.
     },
+    &quot;connectorsPlatformConfig&quot;: { # Configuration for the Connectors Platform add-on. # Configuration for the Connectors Platform add-on.
+      &quot;enabled&quot;: True or False, # Flag that specifies whether the Connectors Platform add-on is enabled.
+      &quot;expiresAt&quot;: &quot;A String&quot;, # Output only. Time at which the Connectors Platform add-on expires in in milliseconds since epoch. If unspecified, the add-on will never expire.
+    },
+    &quot;integrationConfig&quot;: { # Configuration for the Integration add-on. # Configuration for the Integration add-on.
+      &quot;enabled&quot;: True or False, # Flag that specifies whether the Integration add-on is enabled.
+    },
     &quot;monetizationConfig&quot;: { # Configuration for the Monetization add-on. # Configuration for the Monetization add-on.
       &quot;enabled&quot;: True or False, # Flag that specifies whether the Monetization add-on is enabled.
     },
@@ -511,6 +525,13 @@
     &quot;advancedApiOpsConfig&quot;: { # Configuration for the Advanced API Ops add-on. # Configuration for the Advanced API Ops add-on.
       &quot;enabled&quot;: True or False, # Flag that specifies whether the Advanced API Ops add-on is enabled.
     },
+    &quot;connectorsPlatformConfig&quot;: { # Configuration for the Connectors Platform add-on. # Configuration for the Connectors Platform add-on.
+      &quot;enabled&quot;: True or False, # Flag that specifies whether the Connectors Platform add-on is enabled.
+      &quot;expiresAt&quot;: &quot;A String&quot;, # Output only. Time at which the Connectors Platform add-on expires in in milliseconds since epoch. If unspecified, the add-on will never expire.
+    },
+    &quot;integrationConfig&quot;: { # Configuration for the Integration add-on. # Configuration for the Integration add-on.
+      &quot;enabled&quot;: True or False, # Flag that specifies whether the Integration add-on is enabled.
+    },
     &quot;monetizationConfig&quot;: { # Configuration for the Monetization add-on. # Configuration for the Monetization add-on.
       &quot;enabled&quot;: True or False, # Flag that specifies whether the Monetization add-on is enabled.
     },
@@ -592,6 +613,13 @@
     &quot;advancedApiOpsConfig&quot;: { # Configuration for the Advanced API Ops add-on. # Configuration for the Advanced API Ops add-on.
       &quot;enabled&quot;: True or False, # Flag that specifies whether the Advanced API Ops add-on is enabled.
     },
+    &quot;connectorsPlatformConfig&quot;: { # Configuration for the Connectors Platform add-on. # Configuration for the Connectors Platform add-on.
+      &quot;enabled&quot;: True or False, # Flag that specifies whether the Connectors Platform add-on is enabled.
+      &quot;expiresAt&quot;: &quot;A String&quot;, # Output only. Time at which the Connectors Platform add-on expires in in milliseconds since epoch. If unspecified, the add-on will never expire.
+    },
+    &quot;integrationConfig&quot;: { # Configuration for the Integration add-on. # Configuration for the Integration add-on.
+      &quot;enabled&quot;: True or False, # Flag that specifies whether the Integration add-on is enabled.
+    },
     &quot;monetizationConfig&quot;: { # Configuration for the Monetization add-on. # Configuration for the Monetization add-on.
       &quot;enabled&quot;: True or False, # Flag that specifies whether the Monetization add-on is enabled.
     },
@@ -642,6 +670,13 @@
     &quot;advancedApiOpsConfig&quot;: { # Configuration for the Advanced API Ops add-on. # Configuration for the Advanced API Ops add-on.
       &quot;enabled&quot;: True or False, # Flag that specifies whether the Advanced API Ops add-on is enabled.
     },
+    &quot;connectorsPlatformConfig&quot;: { # Configuration for the Connectors Platform add-on. # Configuration for the Connectors Platform add-on.
+      &quot;enabled&quot;: True or False, # Flag that specifies whether the Connectors Platform add-on is enabled.
+      &quot;expiresAt&quot;: &quot;A String&quot;, # Output only. Time at which the Connectors Platform add-on expires in in milliseconds since epoch. If unspecified, the add-on will never expire.
+    },
+    &quot;integrationConfig&quot;: { # Configuration for the Integration add-on. # Configuration for the Integration add-on.
+      &quot;enabled&quot;: True or False, # Flag that specifies whether the Integration add-on is enabled.
+    },
     &quot;monetizationConfig&quot;: { # Configuration for the Monetization add-on. # Configuration for the Monetization add-on.
       &quot;enabled&quot;: True or False, # Flag that specifies whether the Monetization add-on is enabled.
     },
diff --git a/docs/dyn/artifactregistry_v1.projects.locations.repositories.dockerImages.html b/docs/dyn/artifactregistry_v1.projects.locations.repositories.dockerImages.html
index f2330b8..d541747 100644
--- a/docs/dyn/artifactregistry_v1.projects.locations.repositories.dockerImages.html
+++ b/docs/dyn/artifactregistry_v1.projects.locations.repositories.dockerImages.html
@@ -108,7 +108,7 @@
     { # The response from listing docker images.
   &quot;dockerImages&quot;: [ # The docker images returned.
     { # DockerImage represents a docker artifact. The following fields are returned as untyped metadata in the Version resource, using camelcase keys (i.e. metadata.imageSizeBytes): - imageSizeBytes - mediaType - buildTime
-      &quot;buildTime&quot;: &quot;A String&quot;, # The time this image was built. This field is returned as the &#x27;metadata.buildTime&#x27; field in the Version resource. The build time is returned to the client as an RFC 3339 string, which can be easily used with the JavaScript Date constructor and keeps the Version timestamps returned via OnePlatform consistent, as JSON marshals google.protobuf.Timestamp into an RFC 3339 string.
+      &quot;buildTime&quot;: &quot;A String&quot;, # The time this image was built. This field is returned as the &#x27;metadata.buildTime&#x27; field in the Version resource. The build time is returned to the client as an RFC 3339 string, which can be easily used with the JavaScript Date constructor.
       &quot;imageSizeBytes&quot;: &quot;A String&quot;, # Calculated size of the image. This field is returned as the &#x27;metadata.imageSizeBytes&#x27; field in the Version resource.
       &quot;mediaType&quot;: &quot;A String&quot;, # Media type of this image, e.g. &quot;application/vnd.docker.distribution.manifest.v2+json&quot;. This field is returned as the &#x27;metadata.mediaType&#x27; field in the Version resource.
       &quot;name&quot;: &quot;A String&quot;, # Required. registry_location, project_id, repository_name and image id forms a unique image name:`projects//locations//repository//dockerImages/`. For example, &quot;projects/test-project/locations/us-west4/repositories/test-repo/dockerImages/ nginx@sha256:e9954c1fc875017be1c3e36eca16be2d9e9bccc4bf072163515467d6a823c7cf&quot;, where &quot;us-west4&quot; is the registry_location, &quot;test-project&quot; is the project_id, &quot;test-repo&quot; is the repository_name and &quot;nginx@sha256:e9954c1fc875017be1c3e36eca16be2d9e9bccc4bf072163515467d6a823c7cf&quot; is the image&#x27;s digest.
diff --git a/docs/dyn/artifactregistry_v1beta2.projects.locations.repositories.html b/docs/dyn/artifactregistry_v1beta2.projects.locations.repositories.html
index d6bed49..7ac538a 100644
--- a/docs/dyn/artifactregistry_v1beta2.projects.locations.repositories.html
+++ b/docs/dyn/artifactregistry_v1beta2.projects.locations.repositories.html
@@ -157,6 +157,10 @@
   &quot;labels&quot;: { # Labels with user-defined metadata. This field may contain up to 64 entries. Label keys and values may be no longer than 63 characters. Label keys must begin with a lowercase letter and may only contain lowercase letters, numeric characters, underscores, and dashes.
     &quot;a_key&quot;: &quot;A String&quot;,
   },
+  &quot;mavenConfig&quot;: { # MavenRepositoryConfig is maven related repository details. Provides additional configuration details for repositories of the maven format type. # Maven repository config contains repository level configuration for the repositories of maven type.
+    &quot;allowSnapshotOverwrites&quot;: True or False, # The repository with this flag will allow publishing the same snapshot versions.
+    &quot;versionPolicy&quot;: &quot;A String&quot;, # Version policy defines the versions that the registry will accept.
+  },
   &quot;name&quot;: &quot;A String&quot;, # The name of the repository, for example: &quot;projects/p1/locations/us-central1/repositories/repo1&quot;.
   &quot;updateTime&quot;: &quot;A String&quot;, # The time when the repository was last updated.
 }
@@ -248,6 +252,10 @@
   &quot;labels&quot;: { # Labels with user-defined metadata. This field may contain up to 64 entries. Label keys and values may be no longer than 63 characters. Label keys must begin with a lowercase letter and may only contain lowercase letters, numeric characters, underscores, and dashes.
     &quot;a_key&quot;: &quot;A String&quot;,
   },
+  &quot;mavenConfig&quot;: { # MavenRepositoryConfig is maven related repository details. Provides additional configuration details for repositories of the maven format type. # Maven repository config contains repository level configuration for the repositories of maven type.
+    &quot;allowSnapshotOverwrites&quot;: True or False, # The repository with this flag will allow publishing the same snapshot versions.
+    &quot;versionPolicy&quot;: &quot;A String&quot;, # Version policy defines the versions that the registry will accept.
+  },
   &quot;name&quot;: &quot;A String&quot;, # The name of the repository, for example: &quot;projects/p1/locations/us-central1/repositories/repo1&quot;.
   &quot;updateTime&quot;: &quot;A String&quot;, # The time when the repository was last updated.
 }</pre>
@@ -315,6 +323,10 @@
       &quot;labels&quot;: { # Labels with user-defined metadata. This field may contain up to 64 entries. Label keys and values may be no longer than 63 characters. Label keys must begin with a lowercase letter and may only contain lowercase letters, numeric characters, underscores, and dashes.
         &quot;a_key&quot;: &quot;A String&quot;,
       },
+      &quot;mavenConfig&quot;: { # MavenRepositoryConfig is maven related repository details. Provides additional configuration details for repositories of the maven format type. # Maven repository config contains repository level configuration for the repositories of maven type.
+        &quot;allowSnapshotOverwrites&quot;: True or False, # The repository with this flag will allow publishing the same snapshot versions.
+        &quot;versionPolicy&quot;: &quot;A String&quot;, # Version policy defines the versions that the registry will accept.
+      },
       &quot;name&quot;: &quot;A String&quot;, # The name of the repository, for example: &quot;projects/p1/locations/us-central1/repositories/repo1&quot;.
       &quot;updateTime&quot;: &quot;A String&quot;, # The time when the repository was last updated.
     },
@@ -353,6 +365,10 @@
   &quot;labels&quot;: { # Labels with user-defined metadata. This field may contain up to 64 entries. Label keys and values may be no longer than 63 characters. Label keys must begin with a lowercase letter and may only contain lowercase letters, numeric characters, underscores, and dashes.
     &quot;a_key&quot;: &quot;A String&quot;,
   },
+  &quot;mavenConfig&quot;: { # MavenRepositoryConfig is maven related repository details. Provides additional configuration details for repositories of the maven format type. # Maven repository config contains repository level configuration for the repositories of maven type.
+    &quot;allowSnapshotOverwrites&quot;: True or False, # The repository with this flag will allow publishing the same snapshot versions.
+    &quot;versionPolicy&quot;: &quot;A String&quot;, # Version policy defines the versions that the registry will accept.
+  },
   &quot;name&quot;: &quot;A String&quot;, # The name of the repository, for example: &quot;projects/p1/locations/us-central1/repositories/repo1&quot;.
   &quot;updateTime&quot;: &quot;A String&quot;, # The time when the repository was last updated.
 }
@@ -374,6 +390,10 @@
   &quot;labels&quot;: { # Labels with user-defined metadata. This field may contain up to 64 entries. Label keys and values may be no longer than 63 characters. Label keys must begin with a lowercase letter and may only contain lowercase letters, numeric characters, underscores, and dashes.
     &quot;a_key&quot;: &quot;A String&quot;,
   },
+  &quot;mavenConfig&quot;: { # MavenRepositoryConfig is maven related repository details. Provides additional configuration details for repositories of the maven format type. # Maven repository config contains repository level configuration for the repositories of maven type.
+    &quot;allowSnapshotOverwrites&quot;: True or False, # The repository with this flag will allow publishing the same snapshot versions.
+    &quot;versionPolicy&quot;: &quot;A String&quot;, # Version policy defines the versions that the registry will accept.
+  },
   &quot;name&quot;: &quot;A String&quot;, # The name of the repository, for example: &quot;projects/p1/locations/us-central1/repositories/repo1&quot;.
   &quot;updateTime&quot;: &quot;A String&quot;, # The time when the repository was last updated.
 }</pre>
diff --git a/docs/dyn/bigquery_v2.jobs.html b/docs/dyn/bigquery_v2.jobs.html
index b9f6b6f..a076211 100644
--- a/docs/dyn/bigquery_v2.jobs.html
+++ b/docs/dyn/bigquery_v2.jobs.html
@@ -196,6 +196,7 @@
         },
         &quot;destinationTableProperties&quot;: { # [Beta] [Optional] Properties with which to create the destination table if it is new.
           &quot;description&quot;: &quot;A String&quot;, # [Optional] The description for the destination table. This will only be used if the destination table is newly created. If the table already exists and a value different than the current description is provided, the job will fail.
+          &quot;expirationTimestampMillis&quot;: &quot;A String&quot;, # [Optional] The expiration timestamp for the destination table. If this field is set: For a new table, it will set the table&#x27;s expiration time (even if there is a dataset level default table expiration time). For an existing table, it will update the table&#x27;s expiration time. If this field is not set: For a new table, if dataset level default table expiration time is present, that will be applied. For an existing table, no change is made to the table&#x27;s expiration time. Additionally this field is only applied when data is written to an empty table (WRITE_EMPTY) or data is overwritten to a table (WRITE_TRUNCATE).
           &quot;friendlyName&quot;: &quot;A String&quot;, # [Optional] The friendly name for the destination table. This will only be used if the destination table is newly created. If the table already exists and a value different than the current friendly name is provided, the job will fail.
           &quot;labels&quot;: { # [Optional] The labels associated with this table. You can use these to organize and group your tables. This will only be used if the destination table is newly created. If the table already exists and labels are different than the current labels are provided, the job will fail.
             &quot;a_key&quot;: &quot;A String&quot;,
@@ -827,6 +828,7 @@
       },
       &quot;destinationTableProperties&quot;: { # [Beta] [Optional] Properties with which to create the destination table if it is new.
         &quot;description&quot;: &quot;A String&quot;, # [Optional] The description for the destination table. This will only be used if the destination table is newly created. If the table already exists and a value different than the current description is provided, the job will fail.
+        &quot;expirationTimestampMillis&quot;: &quot;A String&quot;, # [Optional] The expiration timestamp for the destination table. If this field is set: For a new table, it will set the table&#x27;s expiration time (even if there is a dataset level default table expiration time). For an existing table, it will update the table&#x27;s expiration time. If this field is not set: For a new table, if dataset level default table expiration time is present, that will be applied. For an existing table, no change is made to the table&#x27;s expiration time. Additionally this field is only applied when data is written to an empty table (WRITE_EMPTY) or data is overwritten to a table (WRITE_TRUNCATE).
         &quot;friendlyName&quot;: &quot;A String&quot;, # [Optional] The friendly name for the destination table. This will only be used if the destination table is newly created. If the table already exists and a value different than the current friendly name is provided, the job will fail.
         &quot;labels&quot;: { # [Optional] The labels associated with this table. You can use these to organize and group your tables. This will only be used if the destination table is newly created. If the table already exists and labels are different than the current labels are provided, the job will fail.
           &quot;a_key&quot;: &quot;A String&quot;,
@@ -1528,6 +1530,7 @@
       },
       &quot;destinationTableProperties&quot;: { # [Beta] [Optional] Properties with which to create the destination table if it is new.
         &quot;description&quot;: &quot;A String&quot;, # [Optional] The description for the destination table. This will only be used if the destination table is newly created. If the table already exists and a value different than the current description is provided, the job will fail.
+        &quot;expirationTimestampMillis&quot;: &quot;A String&quot;, # [Optional] The expiration timestamp for the destination table. If this field is set: For a new table, it will set the table&#x27;s expiration time (even if there is a dataset level default table expiration time). For an existing table, it will update the table&#x27;s expiration time. If this field is not set: For a new table, if dataset level default table expiration time is present, that will be applied. For an existing table, no change is made to the table&#x27;s expiration time. Additionally this field is only applied when data is written to an empty table (WRITE_EMPTY) or data is overwritten to a table (WRITE_TRUNCATE).
         &quot;friendlyName&quot;: &quot;A String&quot;, # [Optional] The friendly name for the destination table. This will only be used if the destination table is newly created. If the table already exists and a value different than the current friendly name is provided, the job will fail.
         &quot;labels&quot;: { # [Optional] The labels associated with this table. You can use these to organize and group your tables. This will only be used if the destination table is newly created. If the table already exists and labels are different than the current labels are provided, the job will fail.
           &quot;a_key&quot;: &quot;A String&quot;,
@@ -2134,6 +2137,7 @@
       },
       &quot;destinationTableProperties&quot;: { # [Beta] [Optional] Properties with which to create the destination table if it is new.
         &quot;description&quot;: &quot;A String&quot;, # [Optional] The description for the destination table. This will only be used if the destination table is newly created. If the table already exists and a value different than the current description is provided, the job will fail.
+        &quot;expirationTimestampMillis&quot;: &quot;A String&quot;, # [Optional] The expiration timestamp for the destination table. If this field is set: For a new table, it will set the table&#x27;s expiration time (even if there is a dataset level default table expiration time). For an existing table, it will update the table&#x27;s expiration time. If this field is not set: For a new table, if dataset level default table expiration time is present, that will be applied. For an existing table, no change is made to the table&#x27;s expiration time. Additionally this field is only applied when data is written to an empty table (WRITE_EMPTY) or data is overwritten to a table (WRITE_TRUNCATE).
         &quot;friendlyName&quot;: &quot;A String&quot;, # [Optional] The friendly name for the destination table. This will only be used if the destination table is newly created. If the table already exists and a value different than the current friendly name is provided, the job will fail.
         &quot;labels&quot;: { # [Optional] The labels associated with this table. You can use these to organize and group your tables. This will only be used if the destination table is newly created. If the table already exists and labels are different than the current labels are provided, the job will fail.
           &quot;a_key&quot;: &quot;A String&quot;,
@@ -2763,6 +2767,7 @@
           },
           &quot;destinationTableProperties&quot;: { # [Beta] [Optional] Properties with which to create the destination table if it is new.
             &quot;description&quot;: &quot;A String&quot;, # [Optional] The description for the destination table. This will only be used if the destination table is newly created. If the table already exists and a value different than the current description is provided, the job will fail.
+            &quot;expirationTimestampMillis&quot;: &quot;A String&quot;, # [Optional] The expiration timestamp for the destination table. If this field is set: For a new table, it will set the table&#x27;s expiration time (even if there is a dataset level default table expiration time). For an existing table, it will update the table&#x27;s expiration time. If this field is not set: For a new table, if dataset level default table expiration time is present, that will be applied. For an existing table, no change is made to the table&#x27;s expiration time. Additionally this field is only applied when data is written to an empty table (WRITE_EMPTY) or data is overwritten to a table (WRITE_TRUNCATE).
             &quot;friendlyName&quot;: &quot;A String&quot;, # [Optional] The friendly name for the destination table. This will only be used if the destination table is newly created. If the table already exists and a value different than the current friendly name is provided, the job will fail.
             &quot;labels&quot;: { # [Optional] The labels associated with this table. You can use these to organize and group your tables. This will only be used if the destination table is newly created. If the table already exists and labels are different than the current labels are provided, the job will fail.
               &quot;a_key&quot;: &quot;A String&quot;,
diff --git a/docs/dyn/bigtableadmin_v2.projects.instances.appProfiles.html b/docs/dyn/bigtableadmin_v2.projects.instances.appProfiles.html
index b1d391e..2c674c6 100644
--- a/docs/dyn/bigtableadmin_v2.projects.instances.appProfiles.html
+++ b/docs/dyn/bigtableadmin_v2.projects.instances.appProfiles.html
@@ -114,6 +114,9 @@
   &quot;description&quot;: &quot;A String&quot;, # Long form description of the use case for this AppProfile.
   &quot;etag&quot;: &quot;A String&quot;, # Strongly validated etag for optimistic concurrency control. Preserve the value returned from `GetAppProfile` when calling `UpdateAppProfile` to fail the request if there has been a modification in the mean time. The `update_mask` of the request need not include `etag` for this protection to apply. See [Wikipedia](https://en.wikipedia.org/wiki/HTTP_ETag) and [RFC 7232](https://tools.ietf.org/html/rfc7232#section-2.3) for more details.
   &quot;multiClusterRoutingUseAny&quot;: { # Read/write requests are routed to the nearest cluster in the instance, and will fail over to the nearest cluster that is available in the event of transient errors or delays. Clusters in a region are considered equidistant. Choosing this option sacrifices read-your-writes consistency to improve availability. # Use a multi-cluster routing policy.
+    &quot;clusterIds&quot;: [ # The set of clusters to route to. The order is ignored; clusters will be tried in order of distance. If left empty, all clusters are eligible.
+      &quot;A String&quot;,
+    ],
   },
   &quot;name&quot;: &quot;A String&quot;, # The unique name of the app profile. Values are of the form `projects/{project}/instances/{instance}/appProfiles/_a-zA-Z0-9*`.
   &quot;singleClusterRouting&quot;: { # Unconditionally routes all read/write requests to a specific cluster. This option preserves read-your-writes consistency but does not improve availability. # Use a single-cluster routing policy.
@@ -136,6 +139,9 @@
   &quot;description&quot;: &quot;A String&quot;, # Long form description of the use case for this AppProfile.
   &quot;etag&quot;: &quot;A String&quot;, # Strongly validated etag for optimistic concurrency control. Preserve the value returned from `GetAppProfile` when calling `UpdateAppProfile` to fail the request if there has been a modification in the mean time. The `update_mask` of the request need not include `etag` for this protection to apply. See [Wikipedia](https://en.wikipedia.org/wiki/HTTP_ETag) and [RFC 7232](https://tools.ietf.org/html/rfc7232#section-2.3) for more details.
   &quot;multiClusterRoutingUseAny&quot;: { # Read/write requests are routed to the nearest cluster in the instance, and will fail over to the nearest cluster that is available in the event of transient errors or delays. Clusters in a region are considered equidistant. Choosing this option sacrifices read-your-writes consistency to improve availability. # Use a multi-cluster routing policy.
+    &quot;clusterIds&quot;: [ # The set of clusters to route to. The order is ignored; clusters will be tried in order of distance. If left empty, all clusters are eligible.
+      &quot;A String&quot;,
+    ],
   },
   &quot;name&quot;: &quot;A String&quot;, # The unique name of the app profile. Values are of the form `projects/{project}/instances/{instance}/appProfiles/_a-zA-Z0-9*`.
   &quot;singleClusterRouting&quot;: { # Unconditionally routes all read/write requests to a specific cluster. This option preserves read-your-writes consistency but does not improve availability. # Use a single-cluster routing policy.
@@ -182,6 +188,9 @@
   &quot;description&quot;: &quot;A String&quot;, # Long form description of the use case for this AppProfile.
   &quot;etag&quot;: &quot;A String&quot;, # Strongly validated etag for optimistic concurrency control. Preserve the value returned from `GetAppProfile` when calling `UpdateAppProfile` to fail the request if there has been a modification in the mean time. The `update_mask` of the request need not include `etag` for this protection to apply. See [Wikipedia](https://en.wikipedia.org/wiki/HTTP_ETag) and [RFC 7232](https://tools.ietf.org/html/rfc7232#section-2.3) for more details.
   &quot;multiClusterRoutingUseAny&quot;: { # Read/write requests are routed to the nearest cluster in the instance, and will fail over to the nearest cluster that is available in the event of transient errors or delays. Clusters in a region are considered equidistant. Choosing this option sacrifices read-your-writes consistency to improve availability. # Use a multi-cluster routing policy.
+    &quot;clusterIds&quot;: [ # The set of clusters to route to. The order is ignored; clusters will be tried in order of distance. If left empty, all clusters are eligible.
+      &quot;A String&quot;,
+    ],
   },
   &quot;name&quot;: &quot;A String&quot;, # The unique name of the app profile. Values are of the form `projects/{project}/instances/{instance}/appProfiles/_a-zA-Z0-9*`.
   &quot;singleClusterRouting&quot;: { # Unconditionally routes all read/write requests to a specific cluster. This option preserves read-your-writes consistency but does not improve availability. # Use a single-cluster routing policy.
@@ -213,6 +222,9 @@
       &quot;description&quot;: &quot;A String&quot;, # Long form description of the use case for this AppProfile.
       &quot;etag&quot;: &quot;A String&quot;, # Strongly validated etag for optimistic concurrency control. Preserve the value returned from `GetAppProfile` when calling `UpdateAppProfile` to fail the request if there has been a modification in the mean time. The `update_mask` of the request need not include `etag` for this protection to apply. See [Wikipedia](https://en.wikipedia.org/wiki/HTTP_ETag) and [RFC 7232](https://tools.ietf.org/html/rfc7232#section-2.3) for more details.
       &quot;multiClusterRoutingUseAny&quot;: { # Read/write requests are routed to the nearest cluster in the instance, and will fail over to the nearest cluster that is available in the event of transient errors or delays. Clusters in a region are considered equidistant. Choosing this option sacrifices read-your-writes consistency to improve availability. # Use a multi-cluster routing policy.
+        &quot;clusterIds&quot;: [ # The set of clusters to route to. The order is ignored; clusters will be tried in order of distance. If left empty, all clusters are eligible.
+          &quot;A String&quot;,
+        ],
       },
       &quot;name&quot;: &quot;A String&quot;, # The unique name of the app profile. Values are of the form `projects/{project}/instances/{instance}/appProfiles/_a-zA-Z0-9*`.
       &quot;singleClusterRouting&quot;: { # Unconditionally routes all read/write requests to a specific cluster. This option preserves read-your-writes consistency but does not improve availability. # Use a single-cluster routing policy.
@@ -255,6 +267,9 @@
   &quot;description&quot;: &quot;A String&quot;, # Long form description of the use case for this AppProfile.
   &quot;etag&quot;: &quot;A String&quot;, # Strongly validated etag for optimistic concurrency control. Preserve the value returned from `GetAppProfile` when calling `UpdateAppProfile` to fail the request if there has been a modification in the mean time. The `update_mask` of the request need not include `etag` for this protection to apply. See [Wikipedia](https://en.wikipedia.org/wiki/HTTP_ETag) and [RFC 7232](https://tools.ietf.org/html/rfc7232#section-2.3) for more details.
   &quot;multiClusterRoutingUseAny&quot;: { # Read/write requests are routed to the nearest cluster in the instance, and will fail over to the nearest cluster that is available in the event of transient errors or delays. Clusters in a region are considered equidistant. Choosing this option sacrifices read-your-writes consistency to improve availability. # Use a multi-cluster routing policy.
+    &quot;clusterIds&quot;: [ # The set of clusters to route to. The order is ignored; clusters will be tried in order of distance. If left empty, all clusters are eligible.
+      &quot;A String&quot;,
+    ],
   },
   &quot;name&quot;: &quot;A String&quot;, # The unique name of the app profile. Values are of the form `projects/{project}/instances/{instance}/appProfiles/_a-zA-Z0-9*`.
   &quot;singleClusterRouting&quot;: { # Unconditionally routes all read/write requests to a specific cluster. This option preserves read-your-writes consistency but does not improve availability. # Use a single-cluster routing policy.
diff --git a/docs/dyn/cloudasset_v1.assets.html b/docs/dyn/cloudasset_v1.assets.html
index c327920..bb85e6a 100644
--- a/docs/dyn/cloudasset_v1.assets.html
+++ b/docs/dyn/cloudasset_v1.assets.html
@@ -262,7 +262,7 @@
                 &quot;hotFixId&quot;: &quot;A String&quot;, # Unique identifier associated with a particular QFE update.
                 &quot;installTime&quot;: &quot;A String&quot;, # Date that the QFE update was installed. Mapped from installed_on field.
               },
-              &quot;windowsApplication&quot;: { # Contains information about a Windows application as retrieved from the Windows Registry. For more information about these fields, see [Windows Installer Properties for the Uninstall Registry](https://docs.microsoft.com/en-us/windows/win32/msi/uninstall-registry-key){: class=&quot;external&quot; } # Details of Windows Application.
+              &quot;windowsApplication&quot;: { # Contains information about a Windows application that is retrieved from the Windows Registry. For more information about these fields, see Windows Installer Properties for the Uninstall Registry. # Details of Windows Application.
                 &quot;displayName&quot;: &quot;A String&quot;, # The name of the application or product.
                 &quot;displayVersion&quot;: &quot;A String&quot;, # The version of the product or application in string format.
                 &quot;helpLink&quot;: &quot;A String&quot;, # The internet address for technical support.
@@ -334,7 +334,7 @@
                 &quot;hotFixId&quot;: &quot;A String&quot;, # Unique identifier associated with a particular QFE update.
                 &quot;installTime&quot;: &quot;A String&quot;, # Date that the QFE update was installed. Mapped from installed_on field.
               },
-              &quot;windowsApplication&quot;: { # Contains information about a Windows application as retrieved from the Windows Registry. For more information about these fields, see [Windows Installer Properties for the Uninstall Registry](https://docs.microsoft.com/en-us/windows/win32/msi/uninstall-registry-key){: class=&quot;external&quot; } # Details of Windows Application.
+              &quot;windowsApplication&quot;: { # Contains information about a Windows application that is retrieved from the Windows Registry. For more information about these fields, see Windows Installer Properties for the Uninstall Registry. # Details of Windows Application.
                 &quot;displayName&quot;: &quot;A String&quot;, # The name of the application or product.
                 &quot;displayVersion&quot;: &quot;A String&quot;, # The version of the product or application in string format.
                 &quot;helpLink&quot;: &quot;A String&quot;, # The internet address for technical support.
diff --git a/docs/dyn/cloudasset_v1.v1.html b/docs/dyn/cloudasset_v1.v1.html
index cfecf54..be0bc62 100644
--- a/docs/dyn/cloudasset_v1.v1.html
+++ b/docs/dyn/cloudasset_v1.v1.html
@@ -649,7 +649,7 @@
                   &quot;hotFixId&quot;: &quot;A String&quot;, # Unique identifier associated with a particular QFE update.
                   &quot;installTime&quot;: &quot;A String&quot;, # Date that the QFE update was installed. Mapped from installed_on field.
                 },
-                &quot;windowsApplication&quot;: { # Contains information about a Windows application as retrieved from the Windows Registry. For more information about these fields, see [Windows Installer Properties for the Uninstall Registry](https://docs.microsoft.com/en-us/windows/win32/msi/uninstall-registry-key){: class=&quot;external&quot; } # Details of Windows Application.
+                &quot;windowsApplication&quot;: { # Contains information about a Windows application that is retrieved from the Windows Registry. For more information about these fields, see Windows Installer Properties for the Uninstall Registry. # Details of Windows Application.
                   &quot;displayName&quot;: &quot;A String&quot;, # The name of the application or product.
                   &quot;displayVersion&quot;: &quot;A String&quot;, # The version of the product or application in string format.
                   &quot;helpLink&quot;: &quot;A String&quot;, # The internet address for technical support.
@@ -721,7 +721,7 @@
                   &quot;hotFixId&quot;: &quot;A String&quot;, # Unique identifier associated with a particular QFE update.
                   &quot;installTime&quot;: &quot;A String&quot;, # Date that the QFE update was installed. Mapped from installed_on field.
                 },
-                &quot;windowsApplication&quot;: { # Contains information about a Windows application as retrieved from the Windows Registry. For more information about these fields, see [Windows Installer Properties for the Uninstall Registry](https://docs.microsoft.com/en-us/windows/win32/msi/uninstall-registry-key){: class=&quot;external&quot; } # Details of Windows Application.
+                &quot;windowsApplication&quot;: { # Contains information about a Windows application that is retrieved from the Windows Registry. For more information about these fields, see Windows Installer Properties for the Uninstall Registry. # Details of Windows Application.
                   &quot;displayName&quot;: &quot;A String&quot;, # The name of the application or product.
                   &quot;displayVersion&quot;: &quot;A String&quot;, # The version of the product or application in string format.
                   &quot;helpLink&quot;: &quot;A String&quot;, # The internet address for technical support.
@@ -1118,7 +1118,7 @@
                   &quot;hotFixId&quot;: &quot;A String&quot;, # Unique identifier associated with a particular QFE update.
                   &quot;installTime&quot;: &quot;A String&quot;, # Date that the QFE update was installed. Mapped from installed_on field.
                 },
-                &quot;windowsApplication&quot;: { # Contains information about a Windows application as retrieved from the Windows Registry. For more information about these fields, see [Windows Installer Properties for the Uninstall Registry](https://docs.microsoft.com/en-us/windows/win32/msi/uninstall-registry-key){: class=&quot;external&quot; } # Details of Windows Application.
+                &quot;windowsApplication&quot;: { # Contains information about a Windows application that is retrieved from the Windows Registry. For more information about these fields, see Windows Installer Properties for the Uninstall Registry. # Details of Windows Application.
                   &quot;displayName&quot;: &quot;A String&quot;, # The name of the application or product.
                   &quot;displayVersion&quot;: &quot;A String&quot;, # The version of the product or application in string format.
                   &quot;helpLink&quot;: &quot;A String&quot;, # The internet address for technical support.
@@ -1190,7 +1190,7 @@
                   &quot;hotFixId&quot;: &quot;A String&quot;, # Unique identifier associated with a particular QFE update.
                   &quot;installTime&quot;: &quot;A String&quot;, # Date that the QFE update was installed. Mapped from installed_on field.
                 },
-                &quot;windowsApplication&quot;: { # Contains information about a Windows application as retrieved from the Windows Registry. For more information about these fields, see [Windows Installer Properties for the Uninstall Registry](https://docs.microsoft.com/en-us/windows/win32/msi/uninstall-registry-key){: class=&quot;external&quot; } # Details of Windows Application.
+                &quot;windowsApplication&quot;: { # Contains information about a Windows application that is retrieved from the Windows Registry. For more information about these fields, see Windows Installer Properties for the Uninstall Registry. # Details of Windows Application.
                   &quot;displayName&quot;: &quot;A String&quot;, # The name of the application or product.
                   &quot;displayVersion&quot;: &quot;A String&quot;, # The version of the product or application in string format.
                   &quot;helpLink&quot;: &quot;A String&quot;, # The internet address for technical support.
diff --git a/docs/dyn/cloudbilling_v1.billingAccounts.html b/docs/dyn/cloudbilling_v1.billingAccounts.html
index 5cb2882..73c4fdb 100644
--- a/docs/dyn/cloudbilling_v1.billingAccounts.html
+++ b/docs/dyn/cloudbilling_v1.billingAccounts.html
@@ -194,7 +194,7 @@
       &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
     },
   ],
-  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member. The `bindings` in a `Policy` can refer to up to 1,500 members; up to 250 of these members can be Google groups. Each occurrence of a member counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other member, then you can add another 1,450 members to the `bindings` in the `Policy`.
     { # Associates `members` with a `role`.
       &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
         &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
@@ -313,7 +313,7 @@
         &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
       },
     ],
-    &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+    &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member. The `bindings` in a `Policy` can refer to up to 1,500 members; up to 250 of these members can be Google groups. Each occurrence of a member counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other member, then you can add another 1,450 members to the `bindings` in the `Policy`.
       { # Associates `members` with a `role`.
         &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
           &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
@@ -355,7 +355,7 @@
       &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
     },
   ],
-  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member. The `bindings` in a `Policy` can refer to up to 1,500 members; up to 250 of these members can be Google groups. Each occurrence of a member counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other member, then you can add another 1,450 members to the `bindings` in the `Policy`.
     { # Associates `members` with a `role`.
       &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
         &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
diff --git a/docs/dyn/cloudidentity_v1beta1.groups.html b/docs/dyn/cloudidentity_v1beta1.groups.html
index 6cd4328..18dd332 100644
--- a/docs/dyn/cloudidentity_v1beta1.groups.html
+++ b/docs/dyn/cloudidentity_v1beta1.groups.html
@@ -92,6 +92,9 @@
   <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
 <p class="firstline">Retrieves a `Group`.</p>
 <p class="toc_element">
+  <code><a href="#getSecuritySettings">getSecuritySettings(name, readMask=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Get Security Settings</p>
+<p class="toc_element">
   <code><a href="#list">list(pageSize=None, pageToken=None, parent=None, view=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Lists the `Group` resources under a customer or namespace.</p>
 <p class="toc_element">
@@ -109,6 +112,9 @@
 <p class="toc_element">
   <code><a href="#search_next">search_next(previous_request, previous_response)</a></code></p>
 <p class="firstline">Retrieves the next page of results.</p>
+<p class="toc_element">
+  <code><a href="#updateSecuritySettings">updateSecuritySettings(name, body=None, updateMask=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Update Security Settings</p>
 <h3>Method Details</h3>
 <div class="method">
     <code class="details" id="close">close()</code>
@@ -290,6 +296,32 @@
 </div>
 
 <div class="method">
+    <code class="details" id="getSecuritySettings">getSecuritySettings(name, readMask=None, x__xgafv=None)</code>
+  <pre>Get Security Settings
+
+Args:
+  name: string, Required. The security settings to retrieve. Format: `groups/{group_id}/securitySettings` (required)
+  readMask: string, Field-level read mask of which fields to return. &quot;*&quot; returns all fields. If not specified, all fields will be returned. May only contain the following field: `member_restriction`.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # The definiion of security settings.
+  &quot;memberRestriction&quot;: { # The definition of MemberRestriction # The Member Restriction value
+    &quot;evaluation&quot;: { # The evaluated state of this restriction. # The evaluated state of this restriction on a group.
+      &quot;state&quot;: &quot;A String&quot;, # Output only. The current state of the restriction
+    },
+    &quot;query&quot;: &quot;A String&quot;, # Member Restriction as defined by CEL expression. Supported restrictions are: `member.customer_id` and `member.type`. Valid values for `member.type` are `1`, `2` and `3`. They correspond to USER, SERVICE_ACCOUNT, and GROUP respectively. The value for `member.customer_id` only supports `groupCustomerId()` currently which means the customer id of the group will be used for restriction. Supported operators are `&amp;&amp;`, `||` and `==`, corresponding to AND, OR, and EQUAL. Examples: Allow only service accounts of given customer to be members. `member.type == 2 &amp;&amp; member.customer_id == groupCustomerId()` Allow only users or groups to be members. `member.type == 1 || member.type == 3`
+  },
+  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the security settings. Shall be of the form `groups/{group_id}/securitySettings`.
+}</pre>
+</div>
+
+<div class="method">
     <code class="details" id="list">list(pageSize=None, pageToken=None, parent=None, view=None, x__xgafv=None)</code>
   <pre>Lists the `Group` resources under a customer or namespace.
 
@@ -552,4 +584,53 @@
     </pre>
 </div>
 
+<div class="method">
+    <code class="details" id="updateSecuritySettings">updateSecuritySettings(name, body=None, updateMask=None, x__xgafv=None)</code>
+  <pre>Update Security Settings
+
+Args:
+  name: string, Output only. The resource name of the security settings. Shall be of the form `groups/{group_id}/securitySettings`. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # The definiion of security settings.
+  &quot;memberRestriction&quot;: { # The definition of MemberRestriction # The Member Restriction value
+    &quot;evaluation&quot;: { # The evaluated state of this restriction. # The evaluated state of this restriction on a group.
+      &quot;state&quot;: &quot;A String&quot;, # Output only. The current state of the restriction
+    },
+    &quot;query&quot;: &quot;A String&quot;, # Member Restriction as defined by CEL expression. Supported restrictions are: `member.customer_id` and `member.type`. Valid values for `member.type` are `1`, `2` and `3`. They correspond to USER, SERVICE_ACCOUNT, and GROUP respectively. The value for `member.customer_id` only supports `groupCustomerId()` currently which means the customer id of the group will be used for restriction. Supported operators are `&amp;&amp;`, `||` and `==`, corresponding to AND, OR, and EQUAL. Examples: Allow only service accounts of given customer to be members. `member.type == 2 &amp;&amp; member.customer_id == groupCustomerId()` Allow only users or groups to be members. `member.type == 1 || member.type == 3`
+  },
+  &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the security settings. Shall be of the form `groups/{group_id}/securitySettings`.
+}
+
+  updateMask: string, Required. The fully-qualified names of fields to update. May only contain the following field: `member_restriction.query`.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # This resource represents a long-running operation that is the result of a network API call.
+  &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+  &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+    &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+      {
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    ],
+    &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+  },
+  &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+  &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+}</pre>
+</div>
+
 </body></html>
\ No newline at end of file
diff --git a/docs/dyn/cloudidentity_v1beta1.groups.memberships.html b/docs/dyn/cloudidentity_v1beta1.groups.memberships.html
index c77db43..58672c6 100644
--- a/docs/dyn/cloudidentity_v1beta1.groups.memberships.html
+++ b/docs/dyn/cloudidentity_v1beta1.groups.memberships.html
@@ -168,6 +168,11 @@
         &quot;expireTime&quot;: &quot;A String&quot;, # The time at which the `MembershipRole` will expire.
       },
       &quot;name&quot;: &quot;A String&quot;, # The name of the `MembershipRole`. Must be one of `OWNER`, `MANAGER`, `MEMBER`.
+      &quot;restrictionEvaluations&quot;: { # Evaluations of restrictions applied to parent group on this membership. # Evaluations of restrictions applied to parent group on this membership.
+        &quot;memberRestrictionEvaluation&quot;: { # The evaluated state of this restriction. # Evaluation of the member restriction applied to this membership. Empty if the user lacks permission to view the restriction evaluation.
+          &quot;state&quot;: &quot;A String&quot;, # Output only. The current state of the restriction
+        },
+      },
     },
   ],
   &quot;type&quot;: &quot;A String&quot;, # Output only. The type of the membership.
@@ -269,6 +274,11 @@
         &quot;expireTime&quot;: &quot;A String&quot;, # The time at which the `MembershipRole` will expire.
       },
       &quot;name&quot;: &quot;A String&quot;, # The name of the `MembershipRole`. Must be one of `OWNER`, `MANAGER`, `MEMBER`.
+      &quot;restrictionEvaluations&quot;: { # Evaluations of restrictions applied to parent group on this membership. # Evaluations of restrictions applied to parent group on this membership.
+        &quot;memberRestrictionEvaluation&quot;: { # The evaluated state of this restriction. # Evaluation of the member restriction applied to this membership. Empty if the user lacks permission to view the restriction evaluation.
+          &quot;state&quot;: &quot;A String&quot;, # Output only. The current state of the restriction
+        },
+      },
     },
   ],
   &quot;type&quot;: &quot;A String&quot;, # Output only. The type of the membership.
@@ -351,6 +361,11 @@
             &quot;expireTime&quot;: &quot;A String&quot;, # The time at which the `MembershipRole` will expire.
           },
           &quot;name&quot;: &quot;A String&quot;, # The name of the `MembershipRole`. Must be one of `OWNER`, `MANAGER`, `MEMBER`.
+          &quot;restrictionEvaluations&quot;: { # Evaluations of restrictions applied to parent group on this membership. # Evaluations of restrictions applied to parent group on this membership.
+            &quot;memberRestrictionEvaluation&quot;: { # The evaluated state of this restriction. # Evaluation of the member restriction applied to this membership. Empty if the user lacks permission to view the restriction evaluation.
+              &quot;state&quot;: &quot;A String&quot;, # Output only. The current state of the restriction
+            },
+          },
         },
       ],
       &quot;type&quot;: &quot;A String&quot;, # Output only. The type of the membership.
@@ -412,6 +427,11 @@
         &quot;expireTime&quot;: &quot;A String&quot;, # The time at which the `MembershipRole` will expire.
       },
       &quot;name&quot;: &quot;A String&quot;, # The name of the `MembershipRole`. Must be one of `OWNER`, `MANAGER`, `MEMBER`.
+      &quot;restrictionEvaluations&quot;: { # Evaluations of restrictions applied to parent group on this membership. # Evaluations of restrictions applied to parent group on this membership.
+        &quot;memberRestrictionEvaluation&quot;: { # The evaluated state of this restriction. # Evaluation of the member restriction applied to this membership. Empty if the user lacks permission to view the restriction evaluation.
+          &quot;state&quot;: &quot;A String&quot;, # Output only. The current state of the restriction
+        },
+      },
     },
   ],
   &quot;removeRoles&quot;: [ # The `name`s of the `MembershipRole`s to be removed. Adding or removing roles in the same request as updating roles is not supported. It is not possible to remove the `MEMBER` `MembershipRole`. If you wish to delete a `Membership`, call MembershipsService.DeleteMembership instead. Must not contain `MEMBER`. Must not be set if `update_roles_params` is set.
@@ -425,6 +445,11 @@
           &quot;expireTime&quot;: &quot;A String&quot;, # The time at which the `MembershipRole` will expire.
         },
         &quot;name&quot;: &quot;A String&quot;, # The name of the `MembershipRole`. Must be one of `OWNER`, `MANAGER`, `MEMBER`.
+        &quot;restrictionEvaluations&quot;: { # Evaluations of restrictions applied to parent group on this membership. # Evaluations of restrictions applied to parent group on this membership.
+          &quot;memberRestrictionEvaluation&quot;: { # The evaluated state of this restriction. # Evaluation of the member restriction applied to this membership. Empty if the user lacks permission to view the restriction evaluation.
+            &quot;state&quot;: &quot;A String&quot;, # Output only. The current state of the restriction
+          },
+        },
       },
     },
   ],
@@ -456,6 +481,11 @@
           &quot;expireTime&quot;: &quot;A String&quot;, # The time at which the `MembershipRole` will expire.
         },
         &quot;name&quot;: &quot;A String&quot;, # The name of the `MembershipRole`. Must be one of `OWNER`, `MANAGER`, `MEMBER`.
+        &quot;restrictionEvaluations&quot;: { # Evaluations of restrictions applied to parent group on this membership. # Evaluations of restrictions applied to parent group on this membership.
+          &quot;memberRestrictionEvaluation&quot;: { # The evaluated state of this restriction. # Evaluation of the member restriction applied to this membership. Empty if the user lacks permission to view the restriction evaluation.
+            &quot;state&quot;: &quot;A String&quot;, # Output only. The current state of the restriction
+          },
+        },
       },
     ],
     &quot;type&quot;: &quot;A String&quot;, # Output only. The type of the membership.
diff --git a/docs/dyn/cloudsearch_v1.indexing.datasources.html b/docs/dyn/cloudsearch_v1.indexing.datasources.html
index 3571376..716825d 100644
--- a/docs/dyn/cloudsearch_v1.indexing.datasources.html
+++ b/docs/dyn/cloudsearch_v1.indexing.datasources.html
@@ -225,7 +225,7 @@
           &quot;isFacetable&quot;: True or False, # Indicates that the property can be used for generating facets. Cannot be true for properties whose type is object. IsReturnable must be true to set this option. Only supported for Boolean, Enum, and Text properties.
           &quot;isRepeatable&quot;: True or False, # Indicates that multiple values are allowed for the property. For example, a document only has one description but can have multiple comments. Cannot be true for properties whose type is a boolean. If set to false, properties that contain more than one value cause the indexing request for that item to be rejected.
           &quot;isReturnable&quot;: True or False, # Indicates that the property identifies data that should be returned in search results via the Query API. If set to *true*, indicates that Query API users can use matching property fields in results. However, storing fields requires more space allocation and uses more bandwidth for search queries, which impacts performance over large datasets. Set to *true* here only if the field is needed for search results. Cannot be true for properties whose type is an object.
-          &quot;isSortable&quot;: True or False, # Indicates that the property can be used for sorting. Cannot be true for properties that are repeatable. Cannot be true for properties whose type is object or user identifier. IsReturnable must be true to set this option. Only supported for Boolean, Date, Double, Integer, and Timestamp properties.
+          &quot;isSortable&quot;: True or False, # Indicates that the property can be used for sorting. Cannot be true for properties that are repeatable. Cannot be true for properties whose type is object. IsReturnable must be true to set this option. Only supported for Boolean, Date, Double, Integer, and Timestamp properties.
           &quot;isSuggestable&quot;: True or False, # Indicates that the property can be used for generating query suggestions.
           &quot;isWildcardSearchable&quot;: True or False, # Indicates that users can perform wildcard search for this property. Only supported for Text properties. IsReturnable must be true to set this option. In a given datasource maximum of 5 properties can be marked as is_wildcard_searchable.
           &quot;name&quot;: &quot;A String&quot;, # The name of the property. Item indexing requests sent to the Indexing API should set the property name equal to this value. For example, if name is *subject_line*, then indexing requests for document items with subject fields should set the name for that field equal to *subject_line*. Use the name as the identifier for the object property. Once registered as a property for an object, you cannot re-use this name for another property within that object. The name must start with a letter and can only contain letters (A-Z, a-z) or numbers (0-9). The maximum length is 256 characters.
@@ -350,7 +350,7 @@
             &quot;isFacetable&quot;: True or False, # Indicates that the property can be used for generating facets. Cannot be true for properties whose type is object. IsReturnable must be true to set this option. Only supported for Boolean, Enum, and Text properties.
             &quot;isRepeatable&quot;: True or False, # Indicates that multiple values are allowed for the property. For example, a document only has one description but can have multiple comments. Cannot be true for properties whose type is a boolean. If set to false, properties that contain more than one value cause the indexing request for that item to be rejected.
             &quot;isReturnable&quot;: True or False, # Indicates that the property identifies data that should be returned in search results via the Query API. If set to *true*, indicates that Query API users can use matching property fields in results. However, storing fields requires more space allocation and uses more bandwidth for search queries, which impacts performance over large datasets. Set to *true* here only if the field is needed for search results. Cannot be true for properties whose type is an object.
-            &quot;isSortable&quot;: True or False, # Indicates that the property can be used for sorting. Cannot be true for properties that are repeatable. Cannot be true for properties whose type is object or user identifier. IsReturnable must be true to set this option. Only supported for Boolean, Date, Double, Integer, and Timestamp properties.
+            &quot;isSortable&quot;: True or False, # Indicates that the property can be used for sorting. Cannot be true for properties that are repeatable. Cannot be true for properties whose type is object. IsReturnable must be true to set this option. Only supported for Boolean, Date, Double, Integer, and Timestamp properties.
             &quot;isSuggestable&quot;: True or False, # Indicates that the property can be used for generating query suggestions.
             &quot;isWildcardSearchable&quot;: True or False, # Indicates that users can perform wildcard search for this property. Only supported for Text properties. IsReturnable must be true to set this option. In a given datasource maximum of 5 properties can be marked as is_wildcard_searchable.
             &quot;name&quot;: &quot;A String&quot;, # The name of the property. Item indexing requests sent to the Indexing API should set the property name equal to this value. For example, if name is *subject_line*, then indexing requests for document items with subject fields should set the name for that field equal to *subject_line*. Use the name as the identifier for the object property. Once registered as a property for an object, you cannot re-use this name for another property within that object. The name must start with a letter and can only contain letters (A-Z, a-z) or numbers (0-9). The maximum length is 256 characters.
diff --git a/docs/dyn/compute_alpha.backendServices.html b/docs/dyn/compute_alpha.backendServices.html
index 1c03dab..2769027 100644
--- a/docs/dyn/compute_alpha.backendServices.html
+++ b/docs/dyn/compute_alpha.backendServices.html
@@ -302,8 +302,8 @@
           },
           &quot;connectionTrackingPolicy&quot;: { # Connection Tracking configuration for this BackendService.
             &quot;connectionPersistenceOnUnhealthyBackends&quot;: &quot;A String&quot;, # Specifies connection persistence when backends are unhealthy. The default value is DEFAULT_FOR_PROTOCOL. If set to DEFAULT_FOR_PROTOCOL, the existing connections persist on unhealthy backends only for connection-oriented protocols (TCP and SCTP) and only if the Tracking Mode is PER_CONNECTION (default tracking mode) or the Session Affinity is configured for 5-tuple. They do not persist for UDP. If set to NEVER_PERSIST, after a backend becomes unhealthy, the existing connections on the unhealthy backend are never persisted on the unhealthy backend. They are always diverted to newly selected healthy backends (unless all backends are unhealthy). If set to ALWAYS_PERSIST, existing connections always persist on unhealthy backends regardless of protocol and session affinity. It is generally not recommended to use this mode overriding the default.
-            &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity. This is only available in External TCP/UDP load balancer.
-            &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For NLB the minimum(default) is 60 seconds and the maximum is 16 hours. This field will be supported only if the Connection Tracking key is less than 5-tuple.
+            &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity for Network Load Balancing. This option is not available publicly.
+            &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For Network Load Balancer the default is 60 seconds. This option is not available publicly. This field will be supported only if the Connection Tracking key is less than 5-tuple.
             &quot;trackingMode&quot;: &quot;A String&quot;, # Specifies the key used for connection tracking. There are two options: PER_CONNECTION: This is the default mode. The Connection Tracking is performed as per the Connection Key (default Hash Method) for the specific protocol. PER_SESSION: The Connection Tracking is performed as per the configured Session Affinity. It matches the configured Session Affinity.
           },
           &quot;consistentHash&quot;: { # This message defines settings for a consistent hash style load balancer. # Consistent Hash-based load balancing can be used to provide soft session affinity based on HTTP headers, cookies or other properties. This load balancing policy is applicable only for HTTP connections. The affinity to a particular destination host will be lost when one or more hosts are added/removed from the destination service. This field specifies parameters that control consistent hashing. This field is only applicable when localityLbPolicy is set to MAGLEV or RING_HASH. This field is applicable to either: - A regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2, and load_balancing_scheme set to INTERNAL_MANAGED. - A global backend service with the load_balancing_scheme set to INTERNAL_SELF_MANAGED. Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
@@ -891,8 +891,8 @@
   },
   &quot;connectionTrackingPolicy&quot;: { # Connection Tracking configuration for this BackendService.
     &quot;connectionPersistenceOnUnhealthyBackends&quot;: &quot;A String&quot;, # Specifies connection persistence when backends are unhealthy. The default value is DEFAULT_FOR_PROTOCOL. If set to DEFAULT_FOR_PROTOCOL, the existing connections persist on unhealthy backends only for connection-oriented protocols (TCP and SCTP) and only if the Tracking Mode is PER_CONNECTION (default tracking mode) or the Session Affinity is configured for 5-tuple. They do not persist for UDP. If set to NEVER_PERSIST, after a backend becomes unhealthy, the existing connections on the unhealthy backend are never persisted on the unhealthy backend. They are always diverted to newly selected healthy backends (unless all backends are unhealthy). If set to ALWAYS_PERSIST, existing connections always persist on unhealthy backends regardless of protocol and session affinity. It is generally not recommended to use this mode overriding the default.
-    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity. This is only available in External TCP/UDP load balancer.
-    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For NLB the minimum(default) is 60 seconds and the maximum is 16 hours. This field will be supported only if the Connection Tracking key is less than 5-tuple.
+    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity for Network Load Balancing. This option is not available publicly.
+    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For Network Load Balancer the default is 60 seconds. This option is not available publicly. This field will be supported only if the Connection Tracking key is less than 5-tuple.
     &quot;trackingMode&quot;: &quot;A String&quot;, # Specifies the key used for connection tracking. There are two options: PER_CONNECTION: This is the default mode. The Connection Tracking is performed as per the Connection Key (default Hash Method) for the specific protocol. PER_SESSION: The Connection Tracking is performed as per the configured Session Affinity. It matches the configured Session Affinity.
   },
   &quot;consistentHash&quot;: { # This message defines settings for a consistent hash style load balancer. # Consistent Hash-based load balancing can be used to provide soft session affinity based on HTTP headers, cookies or other properties. This load balancing policy is applicable only for HTTP connections. The affinity to a particular destination host will be lost when one or more hosts are added/removed from the destination service. This field specifies parameters that control consistent hashing. This field is only applicable when localityLbPolicy is set to MAGLEV or RING_HASH. This field is applicable to either: - A regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2, and load_balancing_scheme set to INTERNAL_MANAGED. - A global backend service with the load_balancing_scheme set to INTERNAL_SELF_MANAGED. Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
@@ -1445,8 +1445,8 @@
   },
   &quot;connectionTrackingPolicy&quot;: { # Connection Tracking configuration for this BackendService.
     &quot;connectionPersistenceOnUnhealthyBackends&quot;: &quot;A String&quot;, # Specifies connection persistence when backends are unhealthy. The default value is DEFAULT_FOR_PROTOCOL. If set to DEFAULT_FOR_PROTOCOL, the existing connections persist on unhealthy backends only for connection-oriented protocols (TCP and SCTP) and only if the Tracking Mode is PER_CONNECTION (default tracking mode) or the Session Affinity is configured for 5-tuple. They do not persist for UDP. If set to NEVER_PERSIST, after a backend becomes unhealthy, the existing connections on the unhealthy backend are never persisted on the unhealthy backend. They are always diverted to newly selected healthy backends (unless all backends are unhealthy). If set to ALWAYS_PERSIST, existing connections always persist on unhealthy backends regardless of protocol and session affinity. It is generally not recommended to use this mode overriding the default.
-    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity. This is only available in External TCP/UDP load balancer.
-    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For NLB the minimum(default) is 60 seconds and the maximum is 16 hours. This field will be supported only if the Connection Tracking key is less than 5-tuple.
+    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity for Network Load Balancing. This option is not available publicly.
+    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For Network Load Balancer the default is 60 seconds. This option is not available publicly. This field will be supported only if the Connection Tracking key is less than 5-tuple.
     &quot;trackingMode&quot;: &quot;A String&quot;, # Specifies the key used for connection tracking. There are two options: PER_CONNECTION: This is the default mode. The Connection Tracking is performed as per the Connection Key (default Hash Method) for the specific protocol. PER_SESSION: The Connection Tracking is performed as per the configured Session Affinity. It matches the configured Session Affinity.
   },
   &quot;consistentHash&quot;: { # This message defines settings for a consistent hash style load balancer. # Consistent Hash-based load balancing can be used to provide soft session affinity based on HTTP headers, cookies or other properties. This load balancing policy is applicable only for HTTP connections. The affinity to a particular destination host will be lost when one or more hosts are added/removed from the destination service. This field specifies parameters that control consistent hashing. This field is only applicable when localityLbPolicy is set to MAGLEV or RING_HASH. This field is applicable to either: - A regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2, and load_balancing_scheme set to INTERNAL_MANAGED. - A global backend service with the load_balancing_scheme set to INTERNAL_SELF_MANAGED. Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
@@ -1919,8 +1919,8 @@
       },
       &quot;connectionTrackingPolicy&quot;: { # Connection Tracking configuration for this BackendService.
         &quot;connectionPersistenceOnUnhealthyBackends&quot;: &quot;A String&quot;, # Specifies connection persistence when backends are unhealthy. The default value is DEFAULT_FOR_PROTOCOL. If set to DEFAULT_FOR_PROTOCOL, the existing connections persist on unhealthy backends only for connection-oriented protocols (TCP and SCTP) and only if the Tracking Mode is PER_CONNECTION (default tracking mode) or the Session Affinity is configured for 5-tuple. They do not persist for UDP. If set to NEVER_PERSIST, after a backend becomes unhealthy, the existing connections on the unhealthy backend are never persisted on the unhealthy backend. They are always diverted to newly selected healthy backends (unless all backends are unhealthy). If set to ALWAYS_PERSIST, existing connections always persist on unhealthy backends regardless of protocol and session affinity. It is generally not recommended to use this mode overriding the default.
-        &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity. This is only available in External TCP/UDP load balancer.
-        &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For NLB the minimum(default) is 60 seconds and the maximum is 16 hours. This field will be supported only if the Connection Tracking key is less than 5-tuple.
+        &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity for Network Load Balancing. This option is not available publicly.
+        &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For Network Load Balancer the default is 60 seconds. This option is not available publicly. This field will be supported only if the Connection Tracking key is less than 5-tuple.
         &quot;trackingMode&quot;: &quot;A String&quot;, # Specifies the key used for connection tracking. There are two options: PER_CONNECTION: This is the default mode. The Connection Tracking is performed as per the Connection Key (default Hash Method) for the specific protocol. PER_SESSION: The Connection Tracking is performed as per the configured Session Affinity. It matches the configured Session Affinity.
       },
       &quot;consistentHash&quot;: { # This message defines settings for a consistent hash style load balancer. # Consistent Hash-based load balancing can be used to provide soft session affinity based on HTTP headers, cookies or other properties. This load balancing policy is applicable only for HTTP connections. The affinity to a particular destination host will be lost when one or more hosts are added/removed from the destination service. This field specifies parameters that control consistent hashing. This field is only applicable when localityLbPolicy is set to MAGLEV or RING_HASH. This field is applicable to either: - A regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2, and load_balancing_scheme set to INTERNAL_MANAGED. - A global backend service with the load_balancing_scheme set to INTERNAL_SELF_MANAGED. Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
@@ -2354,8 +2354,8 @@
   },
   &quot;connectionTrackingPolicy&quot;: { # Connection Tracking configuration for this BackendService.
     &quot;connectionPersistenceOnUnhealthyBackends&quot;: &quot;A String&quot;, # Specifies connection persistence when backends are unhealthy. The default value is DEFAULT_FOR_PROTOCOL. If set to DEFAULT_FOR_PROTOCOL, the existing connections persist on unhealthy backends only for connection-oriented protocols (TCP and SCTP) and only if the Tracking Mode is PER_CONNECTION (default tracking mode) or the Session Affinity is configured for 5-tuple. They do not persist for UDP. If set to NEVER_PERSIST, after a backend becomes unhealthy, the existing connections on the unhealthy backend are never persisted on the unhealthy backend. They are always diverted to newly selected healthy backends (unless all backends are unhealthy). If set to ALWAYS_PERSIST, existing connections always persist on unhealthy backends regardless of protocol and session affinity. It is generally not recommended to use this mode overriding the default.
-    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity. This is only available in External TCP/UDP load balancer.
-    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For NLB the minimum(default) is 60 seconds and the maximum is 16 hours. This field will be supported only if the Connection Tracking key is less than 5-tuple.
+    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity for Network Load Balancing. This option is not available publicly.
+    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For Network Load Balancer the default is 60 seconds. This option is not available publicly. This field will be supported only if the Connection Tracking key is less than 5-tuple.
     &quot;trackingMode&quot;: &quot;A String&quot;, # Specifies the key used for connection tracking. There are two options: PER_CONNECTION: This is the default mode. The Connection Tracking is performed as per the Connection Key (default Hash Method) for the specific protocol. PER_SESSION: The Connection Tracking is performed as per the configured Session Affinity. It matches the configured Session Affinity.
   },
   &quot;consistentHash&quot;: { # This message defines settings for a consistent hash style load balancer. # Consistent Hash-based load balancing can be used to provide soft session affinity based on HTTP headers, cookies or other properties. This load balancing policy is applicable only for HTTP connections. The affinity to a particular destination host will be lost when one or more hosts are added/removed from the destination service. This field specifies parameters that control consistent hashing. This field is only applicable when localityLbPolicy is set to MAGLEV or RING_HASH. This field is applicable to either: - A regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2, and load_balancing_scheme set to INTERNAL_MANAGED. - A global backend service with the load_balancing_scheme set to INTERNAL_SELF_MANAGED. Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
@@ -3200,8 +3200,8 @@
   },
   &quot;connectionTrackingPolicy&quot;: { # Connection Tracking configuration for this BackendService.
     &quot;connectionPersistenceOnUnhealthyBackends&quot;: &quot;A String&quot;, # Specifies connection persistence when backends are unhealthy. The default value is DEFAULT_FOR_PROTOCOL. If set to DEFAULT_FOR_PROTOCOL, the existing connections persist on unhealthy backends only for connection-oriented protocols (TCP and SCTP) and only if the Tracking Mode is PER_CONNECTION (default tracking mode) or the Session Affinity is configured for 5-tuple. They do not persist for UDP. If set to NEVER_PERSIST, after a backend becomes unhealthy, the existing connections on the unhealthy backend are never persisted on the unhealthy backend. They are always diverted to newly selected healthy backends (unless all backends are unhealthy). If set to ALWAYS_PERSIST, existing connections always persist on unhealthy backends regardless of protocol and session affinity. It is generally not recommended to use this mode overriding the default.
-    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity. This is only available in External TCP/UDP load balancer.
-    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For NLB the minimum(default) is 60 seconds and the maximum is 16 hours. This field will be supported only if the Connection Tracking key is less than 5-tuple.
+    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity for Network Load Balancing. This option is not available publicly.
+    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For Network Load Balancer the default is 60 seconds. This option is not available publicly. This field will be supported only if the Connection Tracking key is less than 5-tuple.
     &quot;trackingMode&quot;: &quot;A String&quot;, # Specifies the key used for connection tracking. There are two options: PER_CONNECTION: This is the default mode. The Connection Tracking is performed as per the Connection Key (default Hash Method) for the specific protocol. PER_SESSION: The Connection Tracking is performed as per the configured Session Affinity. It matches the configured Session Affinity.
   },
   &quot;consistentHash&quot;: { # This message defines settings for a consistent hash style load balancer. # Consistent Hash-based load balancing can be used to provide soft session affinity based on HTTP headers, cookies or other properties. This load balancing policy is applicable only for HTTP connections. The affinity to a particular destination host will be lost when one or more hosts are added/removed from the destination service. This field specifies parameters that control consistent hashing. This field is only applicable when localityLbPolicy is set to MAGLEV or RING_HASH. This field is applicable to either: - A regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2, and load_balancing_scheme set to INTERNAL_MANAGED. - A global backend service with the load_balancing_scheme set to INTERNAL_SELF_MANAGED. Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
diff --git a/docs/dyn/compute_alpha.disks.html b/docs/dyn/compute_alpha.disks.html
index 044d190..3d54086 100644
--- a/docs/dyn/compute_alpha.disks.html
+++ b/docs/dyn/compute_alpha.disks.html
@@ -229,10 +229,10 @@
           &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
           &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
           &quot;diskEncryptionKey&quot;: { # Encrypts the disk using a customer-supplied encryption key or a customer-managed encryption key. Encryption keys do not protect access to metadata of the disk. After you encrypt a disk with a customer-supplied key, you must provide the same key if you use the disk later. For example, to create a disk snapshot, to create a disk image, to create a machine image, or to attach the disk to a virtual machine. After you encrypt a disk with a customer-managed key, the diskEncryptionKey.kmsKeyName is set to a key *version* name once the disk is created. The disk is encrypted with this version of the key. In the response, diskEncryptionKey.kmsKeyName appears in the following format: &quot;diskEncryptionKey.kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key /cryptoKeysVersions/version If you do not provide an encryption key when creating the disk, then the disk is encrypted using an automatically generated key and you don&#x27;t need to provide a key to use the disk later.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;eraseWindowsVssSignature&quot;: True or False, # Specifies whether the disk restored from a source snapshot should erase Windows specific VSS signature.
@@ -278,23 +278,21 @@
           &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the disk used to create this disk. This value identifies the exact disk that was used to create this persistent disk. For example, if you created the persistent disk from a disk that was later deleted and recreated under the same name, the source disk ID would identify the exact version of the disk that was used.
           &quot;sourceImage&quot;: &quot;A String&quot;, # The source image used to create this disk. If the source image is deleted, this field will not be set. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family
           &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
-          &quot;sourceInPlaceSnapshot&quot;: &quot;A String&quot;, # [Deprecated] The source in-place snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/inPlaceSnapshots/inPlaceSnapshots - projects/project/global/inPlaceSnapshots/inPlaceSnapshots - global/inPlaceSnapshots/inPlaceSnapshots
-          &quot;sourceInPlaceSnapshotId&quot;: &quot;A String&quot;, # Deprecated The unique ID of the in-place snapshot used to create this disk. This value identifies the exact in-place snapshot that was used to create this persistent disk. For example, if you created the persistent disk from an in-place snapshot that was later deleted and recreated under the same name, the source in-place snapshot ID would identify the exact version of the in-place snapshot that was used.
           &quot;sourceInstantSnapshot&quot;: &quot;A String&quot;, # The source instant snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /instantSnapshots/instantSnapshot - projects/project/zones/zone/instantSnapshots/instantSnapshot - zones/zone/instantSnapshots/instantSnapshot
           &quot;sourceInstantSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the instant snapshot used to create this disk. This value identifies the exact instant snapshot that was used to create this persistent disk. For example, if you created the persistent disk from an instant snapshot that was later deleted and recreated under the same name, the source instant snapshot ID would identify the exact version of the instant snapshot that was used.
           &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/snapshots/snapshot - projects/project/global/snapshots/snapshot - global/snapshots/snapshot
           &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.
@@ -403,18 +401,18 @@
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource&#x27;s resource id.
   &quot;snapshotEncryptionKey&quot;: { # Encrypts the snapshot using a customer-supplied encryption key. After you encrypt a snapshot using a customer-supplied key, you must provide the same key if you use the snapshot later. For example, you must provide the encryption key when you create a disk from the encrypted snapshot in a future request. Customer-supplied encryption keys do not protect access to metadata of the snapshot. If you do not provide an encryption key when creating the snapshot, then the snapshot will be encrypted using an automatically generated key and you do not need to provide a key to use the snapshot later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDisk&quot;: &quot;A String&quot;, # The source disk used to create this snapshot.
   &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this snapshot. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given disk name.
@@ -574,10 +572,10 @@
   &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
   &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
   &quot;diskEncryptionKey&quot;: { # Encrypts the disk using a customer-supplied encryption key or a customer-managed encryption key. Encryption keys do not protect access to metadata of the disk. After you encrypt a disk with a customer-supplied key, you must provide the same key if you use the disk later. For example, to create a disk snapshot, to create a disk image, to create a machine image, or to attach the disk to a virtual machine. After you encrypt a disk with a customer-managed key, the diskEncryptionKey.kmsKeyName is set to a key *version* name once the disk is created. The disk is encrypted with this version of the key. In the response, diskEncryptionKey.kmsKeyName appears in the following format: &quot;diskEncryptionKey.kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key /cryptoKeysVersions/version If you do not provide an encryption key when creating the disk, then the disk is encrypted using an automatically generated key and you don&#x27;t need to provide a key to use the disk later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;eraseWindowsVssSignature&quot;: True or False, # Specifies whether the disk restored from a source snapshot should erase Windows specific VSS signature.
@@ -623,23 +621,21 @@
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the disk used to create this disk. This value identifies the exact disk that was used to create this persistent disk. For example, if you created the persistent disk from a disk that was later deleted and recreated under the same name, the source disk ID would identify the exact version of the disk that was used.
   &quot;sourceImage&quot;: &quot;A String&quot;, # The source image used to create this disk. If the source image is deleted, this field will not be set. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family
   &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
-  &quot;sourceInPlaceSnapshot&quot;: &quot;A String&quot;, # [Deprecated] The source in-place snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/inPlaceSnapshots/inPlaceSnapshots - projects/project/global/inPlaceSnapshots/inPlaceSnapshots - global/inPlaceSnapshots/inPlaceSnapshots
-  &quot;sourceInPlaceSnapshotId&quot;: &quot;A String&quot;, # Deprecated The unique ID of the in-place snapshot used to create this disk. This value identifies the exact in-place snapshot that was used to create this persistent disk. For example, if you created the persistent disk from an in-place snapshot that was later deleted and recreated under the same name, the source in-place snapshot ID would identify the exact version of the in-place snapshot that was used.
   &quot;sourceInstantSnapshot&quot;: &quot;A String&quot;, # The source instant snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /instantSnapshots/instantSnapshot - projects/project/zones/zone/instantSnapshots/instantSnapshot - zones/zone/instantSnapshots/instantSnapshot
   &quot;sourceInstantSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the instant snapshot used to create this disk. This value identifies the exact instant snapshot that was used to create this persistent disk. For example, if you created the persistent disk from an instant snapshot that was later deleted and recreated under the same name, the source instant snapshot ID would identify the exact version of the instant snapshot that was used.
   &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/snapshots/snapshot - projects/project/global/snapshots/snapshot - global/snapshots/snapshot
   &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.
@@ -776,10 +772,10 @@
   &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
   &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
   &quot;diskEncryptionKey&quot;: { # Encrypts the disk using a customer-supplied encryption key or a customer-managed encryption key. Encryption keys do not protect access to metadata of the disk. After you encrypt a disk with a customer-supplied key, you must provide the same key if you use the disk later. For example, to create a disk snapshot, to create a disk image, to create a machine image, or to attach the disk to a virtual machine. After you encrypt a disk with a customer-managed key, the diskEncryptionKey.kmsKeyName is set to a key *version* name once the disk is created. The disk is encrypted with this version of the key. In the response, diskEncryptionKey.kmsKeyName appears in the following format: &quot;diskEncryptionKey.kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key /cryptoKeysVersions/version If you do not provide an encryption key when creating the disk, then the disk is encrypted using an automatically generated key and you don&#x27;t need to provide a key to use the disk later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;eraseWindowsVssSignature&quot;: True or False, # Specifies whether the disk restored from a source snapshot should erase Windows specific VSS signature.
@@ -825,23 +821,21 @@
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the disk used to create this disk. This value identifies the exact disk that was used to create this persistent disk. For example, if you created the persistent disk from a disk that was later deleted and recreated under the same name, the source disk ID would identify the exact version of the disk that was used.
   &quot;sourceImage&quot;: &quot;A String&quot;, # The source image used to create this disk. If the source image is deleted, this field will not be set. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family
   &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
-  &quot;sourceInPlaceSnapshot&quot;: &quot;A String&quot;, # [Deprecated] The source in-place snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/inPlaceSnapshots/inPlaceSnapshots - projects/project/global/inPlaceSnapshots/inPlaceSnapshots - global/inPlaceSnapshots/inPlaceSnapshots
-  &quot;sourceInPlaceSnapshotId&quot;: &quot;A String&quot;, # Deprecated The unique ID of the in-place snapshot used to create this disk. This value identifies the exact in-place snapshot that was used to create this persistent disk. For example, if you created the persistent disk from an in-place snapshot that was later deleted and recreated under the same name, the source in-place snapshot ID would identify the exact version of the in-place snapshot that was used.
   &quot;sourceInstantSnapshot&quot;: &quot;A String&quot;, # The source instant snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /instantSnapshots/instantSnapshot - projects/project/zones/zone/instantSnapshots/instantSnapshot - zones/zone/instantSnapshots/instantSnapshot
   &quot;sourceInstantSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the instant snapshot used to create this disk. This value identifies the exact instant snapshot that was used to create this persistent disk. For example, if you created the persistent disk from an instant snapshot that was later deleted and recreated under the same name, the source instant snapshot ID would identify the exact version of the instant snapshot that was used.
   &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/snapshots/snapshot - projects/project/global/snapshots/snapshot - global/snapshots/snapshot
   &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.
@@ -943,10 +937,10 @@
       &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
       &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
       &quot;diskEncryptionKey&quot;: { # Encrypts the disk using a customer-supplied encryption key or a customer-managed encryption key. Encryption keys do not protect access to metadata of the disk. After you encrypt a disk with a customer-supplied key, you must provide the same key if you use the disk later. For example, to create a disk snapshot, to create a disk image, to create a machine image, or to attach the disk to a virtual machine. After you encrypt a disk with a customer-managed key, the diskEncryptionKey.kmsKeyName is set to a key *version* name once the disk is created. The disk is encrypted with this version of the key. In the response, diskEncryptionKey.kmsKeyName appears in the following format: &quot;diskEncryptionKey.kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key /cryptoKeysVersions/version If you do not provide an encryption key when creating the disk, then the disk is encrypted using an automatically generated key and you don&#x27;t need to provide a key to use the disk later.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;eraseWindowsVssSignature&quot;: True or False, # Specifies whether the disk restored from a source snapshot should erase Windows specific VSS signature.
@@ -992,23 +986,21 @@
       &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the disk used to create this disk. This value identifies the exact disk that was used to create this persistent disk. For example, if you created the persistent disk from a disk that was later deleted and recreated under the same name, the source disk ID would identify the exact version of the disk that was used.
       &quot;sourceImage&quot;: &quot;A String&quot;, # The source image used to create this disk. If the source image is deleted, this field will not be set. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family
       &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
-      &quot;sourceInPlaceSnapshot&quot;: &quot;A String&quot;, # [Deprecated] The source in-place snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/inPlaceSnapshots/inPlaceSnapshots - projects/project/global/inPlaceSnapshots/inPlaceSnapshots - global/inPlaceSnapshots/inPlaceSnapshots
-      &quot;sourceInPlaceSnapshotId&quot;: &quot;A String&quot;, # Deprecated The unique ID of the in-place snapshot used to create this disk. This value identifies the exact in-place snapshot that was used to create this persistent disk. For example, if you created the persistent disk from an in-place snapshot that was later deleted and recreated under the same name, the source in-place snapshot ID would identify the exact version of the in-place snapshot that was used.
       &quot;sourceInstantSnapshot&quot;: &quot;A String&quot;, # The source instant snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /instantSnapshots/instantSnapshot - projects/project/zones/zone/instantSnapshots/instantSnapshot - zones/zone/instantSnapshots/instantSnapshot
       &quot;sourceInstantSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the instant snapshot used to create this disk. This value identifies the exact instant snapshot that was used to create this persistent disk. For example, if you created the persistent disk from an instant snapshot that was later deleted and recreated under the same name, the source instant snapshot ID would identify the exact version of the instant snapshot that was used.
       &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/snapshots/snapshot - projects/project/global/snapshots/snapshot - global/snapshots/snapshot
       &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.
@@ -1535,10 +1527,10 @@
   &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
   &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
   &quot;diskEncryptionKey&quot;: { # Encrypts the disk using a customer-supplied encryption key or a customer-managed encryption key. Encryption keys do not protect access to metadata of the disk. After you encrypt a disk with a customer-supplied key, you must provide the same key if you use the disk later. For example, to create a disk snapshot, to create a disk image, to create a machine image, or to attach the disk to a virtual machine. After you encrypt a disk with a customer-managed key, the diskEncryptionKey.kmsKeyName is set to a key *version* name once the disk is created. The disk is encrypted with this version of the key. In the response, diskEncryptionKey.kmsKeyName appears in the following format: &quot;diskEncryptionKey.kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key /cryptoKeysVersions/version If you do not provide an encryption key when creating the disk, then the disk is encrypted using an automatically generated key and you don&#x27;t need to provide a key to use the disk later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;eraseWindowsVssSignature&quot;: True or False, # Specifies whether the disk restored from a source snapshot should erase Windows specific VSS signature.
@@ -1584,23 +1576,21 @@
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the disk used to create this disk. This value identifies the exact disk that was used to create this persistent disk. For example, if you created the persistent disk from a disk that was later deleted and recreated under the same name, the source disk ID would identify the exact version of the disk that was used.
   &quot;sourceImage&quot;: &quot;A String&quot;, # The source image used to create this disk. If the source image is deleted, this field will not be set. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family
   &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
-  &quot;sourceInPlaceSnapshot&quot;: &quot;A String&quot;, # [Deprecated] The source in-place snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/inPlaceSnapshots/inPlaceSnapshots - projects/project/global/inPlaceSnapshots/inPlaceSnapshots - global/inPlaceSnapshots/inPlaceSnapshots
-  &quot;sourceInPlaceSnapshotId&quot;: &quot;A String&quot;, # Deprecated The unique ID of the in-place snapshot used to create this disk. This value identifies the exact in-place snapshot that was used to create this persistent disk. For example, if you created the persistent disk from an in-place snapshot that was later deleted and recreated under the same name, the source in-place snapshot ID would identify the exact version of the in-place snapshot that was used.
   &quot;sourceInstantSnapshot&quot;: &quot;A String&quot;, # The source instant snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /instantSnapshots/instantSnapshot - projects/project/zones/zone/instantSnapshots/instantSnapshot - zones/zone/instantSnapshots/instantSnapshot
   &quot;sourceInstantSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the instant snapshot used to create this disk. This value identifies the exact instant snapshot that was used to create this persistent disk. For example, if you created the persistent disk from an instant snapshot that was later deleted and recreated under the same name, the source instant snapshot ID would identify the exact version of the instant snapshot that was used.
   &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/snapshots/snapshot - projects/project/global/snapshots/snapshot - global/snapshots/snapshot
   &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.
diff --git a/docs/dyn/compute_alpha.firewalls.html b/docs/dyn/compute_alpha.firewalls.html
index ffeb8d9..637b6fe 100644
--- a/docs/dyn/compute_alpha.firewalls.html
+++ b/docs/dyn/compute_alpha.firewalls.html
@@ -217,7 +217,7 @@
     &quot;enable&quot;: True or False, # This field denotes whether to enable logging for a particular firewall rule.
     &quot;metadata&quot;: &quot;A String&quot;, # This field can only be specified for a particular firewall rule if logging is enabled for that rule. This field denotes whether to include or exclude metadata for firewall logs.
   },
-  &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+  &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
   &quot;network&quot;: &quot;A String&quot;, # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
   &quot;priority&quot;: 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
@@ -280,7 +280,7 @@
     &quot;enable&quot;: True or False, # This field denotes whether to enable logging for a particular firewall rule.
     &quot;metadata&quot;: &quot;A String&quot;, # This field can only be specified for a particular firewall rule if logging is enabled for that rule. This field denotes whether to include or exclude metadata for firewall logs.
   },
-  &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+  &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
   &quot;network&quot;: &quot;A String&quot;, # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
   &quot;priority&quot;: 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
@@ -412,7 +412,7 @@
         &quot;enable&quot;: True or False, # This field denotes whether to enable logging for a particular firewall rule.
         &quot;metadata&quot;: &quot;A String&quot;, # This field can only be specified for a particular firewall rule if logging is enabled for that rule. This field denotes whether to include or exclude metadata for firewall logs.
       },
-      &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+      &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
       &quot;network&quot;: &quot;A String&quot;, # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
       &quot;priority&quot;: 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
@@ -505,7 +505,7 @@
     &quot;enable&quot;: True or False, # This field denotes whether to enable logging for a particular firewall rule.
     &quot;metadata&quot;: &quot;A String&quot;, # This field can only be specified for a particular firewall rule if logging is enabled for that rule. This field denotes whether to include or exclude metadata for firewall logs.
   },
-  &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+  &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
   &quot;network&quot;: &quot;A String&quot;, # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
   &quot;priority&quot;: 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
@@ -656,7 +656,7 @@
     &quot;enable&quot;: True or False, # This field denotes whether to enable logging for a particular firewall rule.
     &quot;metadata&quot;: &quot;A String&quot;, # This field can only be specified for a particular firewall rule if logging is enabled for that rule. This field denotes whether to include or exclude metadata for firewall logs.
   },
-  &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+  &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
   &quot;network&quot;: &quot;A String&quot;, # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
   &quot;priority&quot;: 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
diff --git a/docs/dyn/compute_alpha.globalOperations.html b/docs/dyn/compute_alpha.globalOperations.html
index c1cdda8..5c90b32 100644
--- a/docs/dyn/compute_alpha.globalOperations.html
+++ b/docs/dyn/compute_alpha.globalOperations.html
@@ -88,7 +88,7 @@
 <p class="firstline">Deletes the specified Operations resource.</p>
 <p class="toc_element">
   <code><a href="#get">get(project, operation, x__xgafv=None)</a></code></p>
-<p class="firstline">Retrieves the specified Operations resource. Gets a list of operations by making a `list()` request.</p>
+<p class="firstline">Retrieves the specified Operations resource.</p>
 <p class="toc_element">
   <code><a href="#list">list(project, filter=None, maxResults=None, orderBy=None, pageToken=None, returnPartialSuccess=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Retrieves a list of Operation resources contained within the specified project.</p>
@@ -237,7 +237,7 @@
 
 <div class="method">
     <code class="details" id="get">get(project, operation, x__xgafv=None)</code>
-  <pre>Retrieves the specified Operations resource. Gets a list of operations by making a `list()` request.
+  <pre>Retrieves the specified Operations resource.
 
 Args:
   project: string, Project ID for this request. (required)
diff --git a/docs/dyn/compute_alpha.html b/docs/dyn/compute_alpha.html
index e99fd0c..79c0a70 100644
--- a/docs/dyn/compute_alpha.html
+++ b/docs/dyn/compute_alpha.html
@@ -345,11 +345,6 @@
 <p class="firstline">Returns the regionHealthChecks Resource.</p>
 
 <p class="toc_element">
-  <code><a href="compute_alpha.regionInPlaceSnapshots.html">regionInPlaceSnapshots()</a></code>
-</p>
-<p class="firstline">Returns the regionInPlaceSnapshots Resource.</p>
-
-<p class="toc_element">
   <code><a href="compute_alpha.regionInstanceGroupManagers.html">regionInstanceGroupManagers()</a></code>
 </p>
 <p class="firstline">Returns the regionInstanceGroupManagers Resource.</p>
@@ -525,11 +520,6 @@
 <p class="firstline">Returns the vpnTunnels Resource.</p>
 
 <p class="toc_element">
-  <code><a href="compute_alpha.zoneInPlaceSnapshots.html">zoneInPlaceSnapshots()</a></code>
-</p>
-<p class="firstline">Returns the zoneInPlaceSnapshots Resource.</p>
-
-<p class="toc_element">
   <code><a href="compute_alpha.zoneOperations.html">zoneOperations()</a></code>
 </p>
 <p class="firstline">Returns the zoneOperations Resource.</p>
diff --git a/docs/dyn/compute_alpha.imageFamilyViews.html b/docs/dyn/compute_alpha.imageFamilyViews.html
index ea2ad72..abbb2cd 100644
--- a/docs/dyn/compute_alpha.imageFamilyViews.html
+++ b/docs/dyn/compute_alpha.imageFamilyViews.html
@@ -129,10 +129,10 @@
     ],
     &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
     &quot;imageEncryptionKey&quot;: { # Encrypts the image using a customer-supplied encryption key. After you encrypt an image with a customer-supplied key, you must provide the same key if you use the image later (e.g. to create a disk from the image). Customer-supplied encryption keys do not protect access to metadata of the disk. If you do not provide an encryption key when creating the image, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the image later.
-      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
       &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
     },
     &quot;kind&quot;: &quot;compute#image&quot;, # [Output Only] Type of the resource. Always compute#image for images.
@@ -188,28 +188,28 @@
     },
     &quot;sourceDisk&quot;: &quot;A String&quot;, # URL of the source disk used to create this image. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /disks/disk - projects/project/zones/zone/disks/disk - zones/zone/disks/disk In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
     &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
       &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
     },
     &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
     &quot;sourceImage&quot;: &quot;A String&quot;, # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
     &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
       &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
     },
     &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
     &quot;sourceSnapshot&quot;: &quot;A String&quot;, # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
     &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
       &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
     },
     &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the snapshot used to create this image. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given snapshot name.
diff --git a/docs/dyn/compute_alpha.images.html b/docs/dyn/compute_alpha.images.html
index 01c51f0..b71465d 100644
--- a/docs/dyn/compute_alpha.images.html
+++ b/docs/dyn/compute_alpha.images.html
@@ -305,10 +305,10 @@
   ],
   &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
   &quot;imageEncryptionKey&quot;: { # Encrypts the image using a customer-supplied encryption key. After you encrypt an image with a customer-supplied key, you must provide the same key if you use the image later (e.g. to create a disk from the image). Customer-supplied encryption keys do not protect access to metadata of the disk. If you do not provide an encryption key when creating the image, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the image later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;kind&quot;: &quot;compute#image&quot;, # [Output Only] Type of the resource. Always compute#image for images.
@@ -364,28 +364,28 @@
   },
   &quot;sourceDisk&quot;: &quot;A String&quot;, # URL of the source disk used to create this image. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /disks/disk - projects/project/zones/zone/disks/disk - zones/zone/disks/disk In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
   &quot;sourceImage&quot;: &quot;A String&quot;, # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
   &quot;sourceSnapshot&quot;: &quot;A String&quot;, # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the snapshot used to create this image. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given snapshot name.
@@ -441,10 +441,10 @@
   ],
   &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
   &quot;imageEncryptionKey&quot;: { # Encrypts the image using a customer-supplied encryption key. After you encrypt an image with a customer-supplied key, you must provide the same key if you use the image later (e.g. to create a disk from the image). Customer-supplied encryption keys do not protect access to metadata of the disk. If you do not provide an encryption key when creating the image, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the image later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;kind&quot;: &quot;compute#image&quot;, # [Output Only] Type of the resource. Always compute#image for images.
@@ -500,28 +500,28 @@
   },
   &quot;sourceDisk&quot;: &quot;A String&quot;, # URL of the source disk used to create this image. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /disks/disk - projects/project/zones/zone/disks/disk - zones/zone/disks/disk In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
   &quot;sourceImage&quot;: &quot;A String&quot;, # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
   &quot;sourceSnapshot&quot;: &quot;A String&quot;, # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the snapshot used to create this image. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given snapshot name.
@@ -675,10 +675,10 @@
   ],
   &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
   &quot;imageEncryptionKey&quot;: { # Encrypts the image using a customer-supplied encryption key. After you encrypt an image with a customer-supplied key, you must provide the same key if you use the image later (e.g. to create a disk from the image). Customer-supplied encryption keys do not protect access to metadata of the disk. If you do not provide an encryption key when creating the image, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the image later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;kind&quot;: &quot;compute#image&quot;, # [Output Only] Type of the resource. Always compute#image for images.
@@ -734,28 +734,28 @@
   },
   &quot;sourceDisk&quot;: &quot;A String&quot;, # URL of the source disk used to create this image. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /disks/disk - projects/project/zones/zone/disks/disk - zones/zone/disks/disk In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
   &quot;sourceImage&quot;: &quot;A String&quot;, # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
   &quot;sourceSnapshot&quot;: &quot;A String&quot;, # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the snapshot used to create this image. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given snapshot name.
@@ -876,10 +876,10 @@
       ],
       &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
       &quot;imageEncryptionKey&quot;: { # Encrypts the image using a customer-supplied encryption key. After you encrypt an image with a customer-supplied key, you must provide the same key if you use the image later (e.g. to create a disk from the image). Customer-supplied encryption keys do not protect access to metadata of the disk. If you do not provide an encryption key when creating the image, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the image later.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;kind&quot;: &quot;compute#image&quot;, # [Output Only] Type of the resource. Always compute#image for images.
@@ -935,28 +935,28 @@
       },
       &quot;sourceDisk&quot;: &quot;A String&quot;, # URL of the source disk used to create this image. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /disks/disk - projects/project/zones/zone/disks/disk - zones/zone/disks/disk In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
       &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
       &quot;sourceImage&quot;: &quot;A String&quot;, # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
       &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
       &quot;sourceSnapshot&quot;: &quot;A String&quot;, # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
       &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the snapshot used to create this image. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given snapshot name.
@@ -1036,10 +1036,10 @@
   ],
   &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
   &quot;imageEncryptionKey&quot;: { # Encrypts the image using a customer-supplied encryption key. After you encrypt an image with a customer-supplied key, you must provide the same key if you use the image later (e.g. to create a disk from the image). Customer-supplied encryption keys do not protect access to metadata of the disk. If you do not provide an encryption key when creating the image, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the image later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;kind&quot;: &quot;compute#image&quot;, # [Output Only] Type of the resource. Always compute#image for images.
@@ -1095,28 +1095,28 @@
   },
   &quot;sourceDisk&quot;: &quot;A String&quot;, # URL of the source disk used to create this image. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /disks/disk - projects/project/zones/zone/disks/disk - zones/zone/disks/disk In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
   &quot;sourceImage&quot;: &quot;A String&quot;, # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
   &quot;sourceSnapshot&quot;: &quot;A String&quot;, # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the snapshot used to create this image. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given snapshot name.
diff --git a/docs/dyn/compute_alpha.instanceGroupManagers.html b/docs/dyn/compute_alpha.instanceGroupManagers.html
index 7033652..e11c090 100644
--- a/docs/dyn/compute_alpha.instanceGroupManagers.html
+++ b/docs/dyn/compute_alpha.instanceGroupManagers.html
@@ -133,7 +133,7 @@
 <p class="firstline">Retrieves the next page of results.</p>
 <p class="toc_element">
   <code><a href="#patch">patch(project, zone, instanceGroupManager, body=None, requestId=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is patched even if the instances in the group are still in the process of being patched. You must separately verify the status of the individual instances with the listManagedInstances method. This method supports PATCH semantics and uses the JSON merge patch format and processing rules.</p>
+<p class="firstline">Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is patched even if the instances in the group are still in the process of being patched. You must separately verify the status of the individual instances with the listManagedInstances method. This method supports PATCH semantics and uses the JSON merge patch format and processing rules. If you update your group to specify a new template or instance configuration, it's possible that your intended specification for each VM in the group is different from the current state of that VM. To learn how to apply an updated configuration to the VMs in a MIG, see Updating instances in a MIG.</p>
 <p class="toc_element">
   <code><a href="#patchPerInstanceConfigs">patchPerInstanceConfigs(project, zone, instanceGroupManager, body=None, requestId=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Inserts or patches per-instance configs for the managed instance group. perInstanceConfig.name serves as a key used to distinguish whether to perform insert or patch.</p>
@@ -172,7 +172,7 @@
 <p class="firstline">Returns permissions that a caller has on the specified resource.</p>
 <p class="toc_element">
   <code><a href="#update">update(project, zone, instanceGroupManager, body=None, requestId=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is updated even if the instances in the group have not yet been updated. You must separately verify the status of the individual instances with the listManagedInstances method.</p>
+<p class="firstline">Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is updated even if the instances in the group have not yet been updated. You must separately verify the status of the individual instances with the listManagedInstances method. If you update your group to specify a new template or instance configuration, it's possible that your intended specification for each VM in the group is different from the current state of that VM. To learn how to apply an updated configuration to the VMs in a MIG, see Updating instances in a MIG.</p>
 <p class="toc_element">
   <code><a href="#updatePerInstanceConfigs">updatePerInstanceConfigs(project, zone, instanceGroupManager, body=None, requestId=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Inserts or updates per-instance configs for the managed instance group. perInstanceConfig.name serves as a key used to distinguish whether to perform insert or patch.</p>
@@ -277,6 +277,16 @@
     &quot;a_key&quot;: { # [Output Only] The name of the scope that contains this set of managed instance groups.
       &quot;instanceGroupManagers&quot;: [ # [Output Only] The list of managed instance groups that are contained in the specified project and zone.
         { # Represents a Managed Instance Group resource. An instance group is a collection of VM instances that you can manage as a single entity. For more information, read Instance groups. For zonal Managed Instance Group, use the instanceGroupManagers resource. For regional Managed Instance Group, use the regionInstanceGroupManagers resource.
+          &quot;allInstancesConfig&quot;: { # Specifies the instances configs overrides that should be applied for all instances in the MIG.
+            &quot;properties&quot;: { # Represents the change that you want to make to the instance properties. # Properties for instances that are created using this instances config. You can add or modify properties using the instanceGroupManagers.patch or regionInstanceGroupManagers.patch. After setting instances_config, you must update your instances to use it; for example, you can use the applyUpdatesToInstances method.
+              &quot;labels&quot;: { # The label key-value pairs that you want to patch onto the instance.
+                &quot;a_key&quot;: &quot;A String&quot;,
+              },
+              &quot;metadata&quot;: { # The metadata key-value pairs that you want to patch onto the instance. For more information, see Project and instance metadata.
+                &quot;a_key&quot;: &quot;A String&quot;,
+              },
+            },
+          },
           &quot;autoHealingPolicies&quot;: [ # The autohealing policy for this managed instance group. You can specify only one value.
             {
               &quot;healthCheck&quot;: &quot;A String&quot;, # The URL for the health check that signals autohealing.
@@ -286,6 +296,7 @@
                 &quot;fixed&quot;: 42, # Specifies a fixed number of VM instances. This must be a positive integer.
                 &quot;percent&quot;: 42, # Specifies a percentage of instances between 0 to 100%, inclusive. For example, specify 80 for 80%.
               },
+              &quot;updateInstances&quot;: &quot;A String&quot;,
             },
           ],
           &quot;baseInstanceName&quot;: &quot;A String&quot;, # The base instance name to use for instances in this group. The value must be 1-58 characters long. Instances are named by appending a hyphen and a random four-character string to the base instance name. The base instance name must comply with RFC1035.
@@ -359,6 +370,10 @@
             },
           },
           &quot;status&quot;: { # [Output Only] The status of this managed instance group.
+            &quot;allInstancesConfig&quot;: { # [Output Only] A status of consistency of Instances&#x27; config applied to instances with Instances&#x27; config defined in managed instance group.
+              &quot;currentRevision&quot;: &quot;A String&quot;, # [Output Only] Current instances&#x27; config revision. This value is in RFC3339 text format.
+              &quot;effective&quot;: True or False, # [Output Only] A bit indicating whether instances&#x27; config has been applied to all managed instances in managed instance group.
+            },
             &quot;autoscaler&quot;: &quot;A String&quot;, # [Output Only] The URL of the Autoscaler that targets this instance group manager.
             &quot;isStable&quot;: True or False, # [Output Only] A bit indicating whether the managed instance group is in a stable state. A stable state means that: none of the instances in the managed instance group is currently undergoing any type of change (for example, creation, restart, or deletion); no future changes are scheduled for instances in the managed instance group; and the managed instance group itself is not being modified.
             &quot;stateful&quot;: { # [Output Only] Stateful status of the given Instance Group Manager.
@@ -876,6 +891,16 @@
   An object of the form:
 
     { # Represents a Managed Instance Group resource. An instance group is a collection of VM instances that you can manage as a single entity. For more information, read Instance groups. For zonal Managed Instance Group, use the instanceGroupManagers resource. For regional Managed Instance Group, use the regionInstanceGroupManagers resource.
+  &quot;allInstancesConfig&quot;: { # Specifies the instances configs overrides that should be applied for all instances in the MIG.
+    &quot;properties&quot;: { # Represents the change that you want to make to the instance properties. # Properties for instances that are created using this instances config. You can add or modify properties using the instanceGroupManagers.patch or regionInstanceGroupManagers.patch. After setting instances_config, you must update your instances to use it; for example, you can use the applyUpdatesToInstances method.
+      &quot;labels&quot;: { # The label key-value pairs that you want to patch onto the instance.
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+      &quot;metadata&quot;: { # The metadata key-value pairs that you want to patch onto the instance. For more information, see Project and instance metadata.
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+    },
+  },
   &quot;autoHealingPolicies&quot;: [ # The autohealing policy for this managed instance group. You can specify only one value.
     {
       &quot;healthCheck&quot;: &quot;A String&quot;, # The URL for the health check that signals autohealing.
@@ -885,6 +910,7 @@
         &quot;fixed&quot;: 42, # Specifies a fixed number of VM instances. This must be a positive integer.
         &quot;percent&quot;: 42, # Specifies a percentage of instances between 0 to 100%, inclusive. For example, specify 80 for 80%.
       },
+      &quot;updateInstances&quot;: &quot;A String&quot;,
     },
   ],
   &quot;baseInstanceName&quot;: &quot;A String&quot;, # The base instance name to use for instances in this group. The value must be 1-58 characters long. Instances are named by appending a hyphen and a random four-character string to the base instance name. The base instance name must comply with RFC1035.
@@ -958,6 +984,10 @@
     },
   },
   &quot;status&quot;: { # [Output Only] The status of this managed instance group.
+    &quot;allInstancesConfig&quot;: { # [Output Only] A status of consistency of Instances&#x27; config applied to instances with Instances&#x27; config defined in managed instance group.
+      &quot;currentRevision&quot;: &quot;A String&quot;, # [Output Only] Current instances&#x27; config revision. This value is in RFC3339 text format.
+      &quot;effective&quot;: True or False, # [Output Only] A bit indicating whether instances&#x27; config has been applied to all managed instances in managed instance group.
+    },
     &quot;autoscaler&quot;: &quot;A String&quot;, # [Output Only] The URL of the Autoscaler that targets this instance group manager.
     &quot;isStable&quot;: True or False, # [Output Only] A bit indicating whether the managed instance group is in a stable state. A stable state means that: none of the instances in the managed instance group is currently undergoing any type of change (for example, creation, restart, or deletion); no future changes are scheduled for instances in the managed instance group; and the managed instance group itself is not being modified.
     &quot;stateful&quot;: { # [Output Only] Stateful status of the given Instance Group Manager.
@@ -1022,6 +1052,16 @@
     The object takes the form of:
 
 { # Represents a Managed Instance Group resource. An instance group is a collection of VM instances that you can manage as a single entity. For more information, read Instance groups. For zonal Managed Instance Group, use the instanceGroupManagers resource. For regional Managed Instance Group, use the regionInstanceGroupManagers resource.
+  &quot;allInstancesConfig&quot;: { # Specifies the instances configs overrides that should be applied for all instances in the MIG.
+    &quot;properties&quot;: { # Represents the change that you want to make to the instance properties. # Properties for instances that are created using this instances config. You can add or modify properties using the instanceGroupManagers.patch or regionInstanceGroupManagers.patch. After setting instances_config, you must update your instances to use it; for example, you can use the applyUpdatesToInstances method.
+      &quot;labels&quot;: { # The label key-value pairs that you want to patch onto the instance.
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+      &quot;metadata&quot;: { # The metadata key-value pairs that you want to patch onto the instance. For more information, see Project and instance metadata.
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+    },
+  },
   &quot;autoHealingPolicies&quot;: [ # The autohealing policy for this managed instance group. You can specify only one value.
     {
       &quot;healthCheck&quot;: &quot;A String&quot;, # The URL for the health check that signals autohealing.
@@ -1031,6 +1071,7 @@
         &quot;fixed&quot;: 42, # Specifies a fixed number of VM instances. This must be a positive integer.
         &quot;percent&quot;: 42, # Specifies a percentage of instances between 0 to 100%, inclusive. For example, specify 80 for 80%.
       },
+      &quot;updateInstances&quot;: &quot;A String&quot;,
     },
   ],
   &quot;baseInstanceName&quot;: &quot;A String&quot;, # The base instance name to use for instances in this group. The value must be 1-58 characters long. Instances are named by appending a hyphen and a random four-character string to the base instance name. The base instance name must comply with RFC1035.
@@ -1104,6 +1145,10 @@
     },
   },
   &quot;status&quot;: { # [Output Only] The status of this managed instance group.
+    &quot;allInstancesConfig&quot;: { # [Output Only] A status of consistency of Instances&#x27; config applied to instances with Instances&#x27; config defined in managed instance group.
+      &quot;currentRevision&quot;: &quot;A String&quot;, # [Output Only] Current instances&#x27; config revision. This value is in RFC3339 text format.
+      &quot;effective&quot;: True or False, # [Output Only] A bit indicating whether instances&#x27; config has been applied to all managed instances in managed instance group.
+    },
     &quot;autoscaler&quot;: &quot;A String&quot;, # [Output Only] The URL of the Autoscaler that targets this instance group manager.
     &quot;isStable&quot;: True or False, # [Output Only] A bit indicating whether the managed instance group is in a stable state. A stable state means that: none of the instances in the managed instance group is currently undergoing any type of change (for example, creation, restart, or deletion); no future changes are scheduled for instances in the managed instance group; and the managed instance group itself is not being modified.
     &quot;stateful&quot;: { # [Output Only] Stateful status of the given Instance Group Manager.
@@ -1237,6 +1282,16 @@
   &quot;id&quot;: &quot;A String&quot;, # [Output Only] Unique identifier for the resource; defined by the server.
   &quot;items&quot;: [ # A list of InstanceGroupManager resources.
     { # Represents a Managed Instance Group resource. An instance group is a collection of VM instances that you can manage as a single entity. For more information, read Instance groups. For zonal Managed Instance Group, use the instanceGroupManagers resource. For regional Managed Instance Group, use the regionInstanceGroupManagers resource.
+      &quot;allInstancesConfig&quot;: { # Specifies the instances configs overrides that should be applied for all instances in the MIG.
+        &quot;properties&quot;: { # Represents the change that you want to make to the instance properties. # Properties for instances that are created using this instances config. You can add or modify properties using the instanceGroupManagers.patch or regionInstanceGroupManagers.patch. After setting instances_config, you must update your instances to use it; for example, you can use the applyUpdatesToInstances method.
+          &quot;labels&quot;: { # The label key-value pairs that you want to patch onto the instance.
+            &quot;a_key&quot;: &quot;A String&quot;,
+          },
+          &quot;metadata&quot;: { # The metadata key-value pairs that you want to patch onto the instance. For more information, see Project and instance metadata.
+            &quot;a_key&quot;: &quot;A String&quot;,
+          },
+        },
+      },
       &quot;autoHealingPolicies&quot;: [ # The autohealing policy for this managed instance group. You can specify only one value.
         {
           &quot;healthCheck&quot;: &quot;A String&quot;, # The URL for the health check that signals autohealing.
@@ -1246,6 +1301,7 @@
             &quot;fixed&quot;: 42, # Specifies a fixed number of VM instances. This must be a positive integer.
             &quot;percent&quot;: 42, # Specifies a percentage of instances between 0 to 100%, inclusive. For example, specify 80 for 80%.
           },
+          &quot;updateInstances&quot;: &quot;A String&quot;,
         },
       ],
       &quot;baseInstanceName&quot;: &quot;A String&quot;, # The base instance name to use for instances in this group. The value must be 1-58 characters long. Instances are named by appending a hyphen and a random four-character string to the base instance name. The base instance name must comply with RFC1035.
@@ -1319,6 +1375,10 @@
         },
       },
       &quot;status&quot;: { # [Output Only] The status of this managed instance group.
+        &quot;allInstancesConfig&quot;: { # [Output Only] A status of consistency of Instances&#x27; config applied to instances with Instances&#x27; config defined in managed instance group.
+          &quot;currentRevision&quot;: &quot;A String&quot;, # [Output Only] Current instances&#x27; config revision. This value is in RFC3339 text format.
+          &quot;effective&quot;: True or False, # [Output Only] A bit indicating whether instances&#x27; config has been applied to all managed instances in managed instance group.
+        },
         &quot;autoscaler&quot;: &quot;A String&quot;, # [Output Only] The URL of the Autoscaler that targets this instance group manager.
         &quot;isStable&quot;: True or False, # [Output Only] A bit indicating whether the managed instance group is in a stable state. A stable state means that: none of the instances in the managed instance group is currently undergoing any type of change (for example, creation, restart, or deletion); no future changes are scheduled for instances in the managed instance group; and the managed instance group itself is not being modified.
         &quot;stateful&quot;: { # [Output Only] Stateful status of the given Instance Group Manager.
@@ -1468,6 +1528,9 @@
     {
   &quot;managedInstances&quot;: [ # [Output Only] The list of instances in the managed instance group.
     { # A Managed Instance resource.
+      &quot;allInstancesConfig&quot;: { # [Output Only] Instances config revision applied to this instance.
+        &quot;revision&quot;: &quot;A String&quot;, # [Output Only] Instances config revision. This value is in RFC3339 text format.
+      },
       &quot;currentAction&quot;: &quot;A String&quot;, # [Output Only] The current action that the managed instance group has scheduled for the instance. Possible values: - NONE The instance is running, and the managed instance group does not have any scheduled actions for this instance. - CREATING The managed instance group is creating this instance. If the group fails to create this instance, it will try again until it is successful. - CREATING_WITHOUT_RETRIES The managed instance group is attempting to create this instance only once. If the group fails to create this instance, it does not try again and the group&#x27;s targetSize value is decreased instead. - RECREATING The managed instance group is recreating this instance. - DELETING The managed instance group is permanently deleting this instance. - ABANDONING The managed instance group is abandoning this instance. The instance will be removed from the instance group and from any target pools that are associated with this group. - RESTARTING The managed instance group is restarting the instance. - REFRESHING The managed instance group is applying configuration changes to the instance without stopping it. For example, the group can update the target pool list for an instance without stopping that instance. - VERIFYING The managed instance group has created the instance and it is in the process of being verified.
       &quot;id&quot;: &quot;A String&quot;, # [Output only] The unique identifier for this resource. This field is empty when instance does not exist.
       &quot;instance&quot;: &quot;A String&quot;, # [Output Only] The URL of the instance. The URL can exist even if the instance has not yet been created.
@@ -1680,7 +1743,7 @@
 
 <div class="method">
     <code class="details" id="patch">patch(project, zone, instanceGroupManager, body=None, requestId=None, x__xgafv=None)</code>
-  <pre>Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is patched even if the instances in the group are still in the process of being patched. You must separately verify the status of the individual instances with the listManagedInstances method. This method supports PATCH semantics and uses the JSON merge patch format and processing rules.
+  <pre>Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is patched even if the instances in the group are still in the process of being patched. You must separately verify the status of the individual instances with the listManagedInstances method. This method supports PATCH semantics and uses the JSON merge patch format and processing rules. If you update your group to specify a new template or instance configuration, it&#x27;s possible that your intended specification for each VM in the group is different from the current state of that VM. To learn how to apply an updated configuration to the VMs in a MIG, see Updating instances in a MIG.
 
 Args:
   project: string, Project ID for this request. (required)
@@ -1690,6 +1753,16 @@
     The object takes the form of:
 
 { # Represents a Managed Instance Group resource. An instance group is a collection of VM instances that you can manage as a single entity. For more information, read Instance groups. For zonal Managed Instance Group, use the instanceGroupManagers resource. For regional Managed Instance Group, use the regionInstanceGroupManagers resource.
+  &quot;allInstancesConfig&quot;: { # Specifies the instances configs overrides that should be applied for all instances in the MIG.
+    &quot;properties&quot;: { # Represents the change that you want to make to the instance properties. # Properties for instances that are created using this instances config. You can add or modify properties using the instanceGroupManagers.patch or regionInstanceGroupManagers.patch. After setting instances_config, you must update your instances to use it; for example, you can use the applyUpdatesToInstances method.
+      &quot;labels&quot;: { # The label key-value pairs that you want to patch onto the instance.
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+      &quot;metadata&quot;: { # The metadata key-value pairs that you want to patch onto the instance. For more information, see Project and instance metadata.
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+    },
+  },
   &quot;autoHealingPolicies&quot;: [ # The autohealing policy for this managed instance group. You can specify only one value.
     {
       &quot;healthCheck&quot;: &quot;A String&quot;, # The URL for the health check that signals autohealing.
@@ -1699,6 +1772,7 @@
         &quot;fixed&quot;: 42, # Specifies a fixed number of VM instances. This must be a positive integer.
         &quot;percent&quot;: 42, # Specifies a percentage of instances between 0 to 100%, inclusive. For example, specify 80 for 80%.
       },
+      &quot;updateInstances&quot;: &quot;A String&quot;,
     },
   ],
   &quot;baseInstanceName&quot;: &quot;A String&quot;, # The base instance name to use for instances in this group. The value must be 1-58 characters long. Instances are named by appending a hyphen and a random four-character string to the base instance name. The base instance name must comply with RFC1035.
@@ -1772,6 +1846,10 @@
     },
   },
   &quot;status&quot;: { # [Output Only] The status of this managed instance group.
+    &quot;allInstancesConfig&quot;: { # [Output Only] A status of consistency of Instances&#x27; config applied to instances with Instances&#x27; config defined in managed instance group.
+      &quot;currentRevision&quot;: &quot;A String&quot;, # [Output Only] Current instances&#x27; config revision. This value is in RFC3339 text format.
+      &quot;effective&quot;: True or False, # [Output Only] A bit indicating whether instances&#x27; config has been applied to all managed instances in managed instance group.
+    },
     &quot;autoscaler&quot;: &quot;A String&quot;, # [Output Only] The URL of the Autoscaler that targets this instance group manager.
     &quot;isStable&quot;: True or False, # [Output Only] A bit indicating whether the managed instance group is in a stable state. A stable state means that: none of the instances in the managed instance group is currently undergoing any type of change (for example, creation, restart, or deletion); no future changes are scheduled for instances in the managed instance group; and the managed instance group itself is not being modified.
     &quot;stateful&quot;: { # [Output Only] Stateful status of the given Instance Group Manager.
@@ -2297,6 +2375,7 @@
         &quot;fixed&quot;: 42, # Specifies a fixed number of VM instances. This must be a positive integer.
         &quot;percent&quot;: 42, # Specifies a percentage of instances between 0 to 100%, inclusive. For example, specify 80 for 80%.
       },
+      &quot;updateInstances&quot;: &quot;A String&quot;,
     },
   ],
 }
@@ -2763,7 +2842,7 @@
 
 <div class="method">
     <code class="details" id="update">update(project, zone, instanceGroupManager, body=None, requestId=None, x__xgafv=None)</code>
-  <pre>Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is updated even if the instances in the group have not yet been updated. You must separately verify the status of the individual instances with the listManagedInstances method.
+  <pre>Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is updated even if the instances in the group have not yet been updated. You must separately verify the status of the individual instances with the listManagedInstances method. If you update your group to specify a new template or instance configuration, it&#x27;s possible that your intended specification for each VM in the group is different from the current state of that VM. To learn how to apply an updated configuration to the VMs in a MIG, see Updating instances in a MIG.
 
 Args:
   project: string, Project ID for this request. (required)
@@ -2773,6 +2852,16 @@
     The object takes the form of:
 
 { # Represents a Managed Instance Group resource. An instance group is a collection of VM instances that you can manage as a single entity. For more information, read Instance groups. For zonal Managed Instance Group, use the instanceGroupManagers resource. For regional Managed Instance Group, use the regionInstanceGroupManagers resource.
+  &quot;allInstancesConfig&quot;: { # Specifies the instances configs overrides that should be applied for all instances in the MIG.
+    &quot;properties&quot;: { # Represents the change that you want to make to the instance properties. # Properties for instances that are created using this instances config. You can add or modify properties using the instanceGroupManagers.patch or regionInstanceGroupManagers.patch. After setting instances_config, you must update your instances to use it; for example, you can use the applyUpdatesToInstances method.
+      &quot;labels&quot;: { # The label key-value pairs that you want to patch onto the instance.
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+      &quot;metadata&quot;: { # The metadata key-value pairs that you want to patch onto the instance. For more information, see Project and instance metadata.
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+    },
+  },
   &quot;autoHealingPolicies&quot;: [ # The autohealing policy for this managed instance group. You can specify only one value.
     {
       &quot;healthCheck&quot;: &quot;A String&quot;, # The URL for the health check that signals autohealing.
@@ -2782,6 +2871,7 @@
         &quot;fixed&quot;: 42, # Specifies a fixed number of VM instances. This must be a positive integer.
         &quot;percent&quot;: 42, # Specifies a percentage of instances between 0 to 100%, inclusive. For example, specify 80 for 80%.
       },
+      &quot;updateInstances&quot;: &quot;A String&quot;,
     },
   ],
   &quot;baseInstanceName&quot;: &quot;A String&quot;, # The base instance name to use for instances in this group. The value must be 1-58 characters long. Instances are named by appending a hyphen and a random four-character string to the base instance name. The base instance name must comply with RFC1035.
@@ -2855,6 +2945,10 @@
     },
   },
   &quot;status&quot;: { # [Output Only] The status of this managed instance group.
+    &quot;allInstancesConfig&quot;: { # [Output Only] A status of consistency of Instances&#x27; config applied to instances with Instances&#x27; config defined in managed instance group.
+      &quot;currentRevision&quot;: &quot;A String&quot;, # [Output Only] Current instances&#x27; config revision. This value is in RFC3339 text format.
+      &quot;effective&quot;: True or False, # [Output Only] A bit indicating whether instances&#x27; config has been applied to all managed instances in managed instance group.
+    },
     &quot;autoscaler&quot;: &quot;A String&quot;, # [Output Only] The URL of the Autoscaler that targets this instance group manager.
     &quot;isStable&quot;: True or False, # [Output Only] A bit indicating whether the managed instance group is in a stable state. A stable state means that: none of the instances in the managed instance group is currently undergoing any type of change (for example, creation, restart, or deletion); no future changes are scheduled for instances in the managed instance group; and the managed instance group itself is not being modified.
     &quot;stateful&quot;: { # [Output Only] Stateful status of the given Instance Group Manager.
diff --git a/docs/dyn/compute_alpha.instanceTemplates.html b/docs/dyn/compute_alpha.instanceTemplates.html
index a15b654..5ad4be1 100644
--- a/docs/dyn/compute_alpha.instanceTemplates.html
+++ b/docs/dyn/compute_alpha.instanceTemplates.html
@@ -195,6 +195,7 @@
   &quot;properties&quot;: { # The instance properties for this instance template.
     &quot;advancedMachineFeatures&quot;: { # Specifies options for controlling advanced machine features. Options that would traditionally be configured in a BIOS belong here. Features that require operating system support may have corresponding entries in the GuestOsFeatures of an Image (e.g., whether or not the OS in the Image supports nested virtualization being enabled or disabled). # Controls for advanced machine-related behavior features.
       &quot;enableNestedVirtualization&quot;: True or False, # Whether to enable nested virtualization or not (default is false).
+      &quot;enableUefiNetworking&quot;: True or False, # Whether to enable UEFI networking for instance creation.
       &quot;numaNodeCount&quot;: 42, # The number of vNUMA nodes.
       &quot;threadsPerCore&quot;: 42, # The number of threads per physical core. To disable simultaneous multithreading (SMT) set this to 1. If unset, the maximum number of threads supported per core by the underlying processor is assumed.
       &quot;visibleCoreCount&quot;: 42, # The number of physical cores to expose to an instance. Multiply by the number of threads per core to compute the total number of virtual CPUs to expose to the instance. If unset, the number of cores is inferred from the instance&#x27;s nominal CPU count and the underlying platform&#x27;s SMT width.
@@ -210,10 +211,10 @@
         &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
         &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
         &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -255,18 +256,18 @@
           ],
           &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
           &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
           &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
         },
@@ -397,7 +398,7 @@
       &quot;externalIpEgressBandwidthTier&quot;: &quot;A String&quot;,
       &quot;totalEgressBandwidthTier&quot;: &quot;A String&quot;,
     },
-    &quot;postKeyRevocationActionType&quot;: &quot;A String&quot;, # PostKeyRevocationActionType of the instance.
+    &quot;postKeyRevocationActionType&quot;: &quot;A String&quot;, # PostKeyRevocationActionType of the instance.(will be deprecated soon)
     &quot;privateIpv6GoogleAccess&quot;: &quot;A String&quot;, # The private IPv6 google access type for VMs. If not specified, use INHERIT_FROM_SUBNETWORK as default.
     &quot;reservationAffinity&quot;: { # Specifies the reservations that this instance can consume from. # Specifies the reservations that instances can consume from.
       &quot;consumeReservationType&quot;: &quot;A String&quot;, # Specifies the type of reservation from which this instance can consume resources: ANY_RESERVATION (default), SPECIFIC_RESERVATION, or NO_RESERVATION. See Consuming reserved instances for examples.
@@ -600,6 +601,7 @@
   &quot;properties&quot;: { # The instance properties for this instance template.
     &quot;advancedMachineFeatures&quot;: { # Specifies options for controlling advanced machine features. Options that would traditionally be configured in a BIOS belong here. Features that require operating system support may have corresponding entries in the GuestOsFeatures of an Image (e.g., whether or not the OS in the Image supports nested virtualization being enabled or disabled). # Controls for advanced machine-related behavior features.
       &quot;enableNestedVirtualization&quot;: True or False, # Whether to enable nested virtualization or not (default is false).
+      &quot;enableUefiNetworking&quot;: True or False, # Whether to enable UEFI networking for instance creation.
       &quot;numaNodeCount&quot;: 42, # The number of vNUMA nodes.
       &quot;threadsPerCore&quot;: 42, # The number of threads per physical core. To disable simultaneous multithreading (SMT) set this to 1. If unset, the maximum number of threads supported per core by the underlying processor is assumed.
       &quot;visibleCoreCount&quot;: 42, # The number of physical cores to expose to an instance. Multiply by the number of threads per core to compute the total number of virtual CPUs to expose to the instance. If unset, the number of cores is inferred from the instance&#x27;s nominal CPU count and the underlying platform&#x27;s SMT width.
@@ -615,10 +617,10 @@
         &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
         &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
         &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -660,18 +662,18 @@
           ],
           &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
           &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
           &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
         },
@@ -802,7 +804,7 @@
       &quot;externalIpEgressBandwidthTier&quot;: &quot;A String&quot;,
       &quot;totalEgressBandwidthTier&quot;: &quot;A String&quot;,
     },
-    &quot;postKeyRevocationActionType&quot;: &quot;A String&quot;, # PostKeyRevocationActionType of the instance.
+    &quot;postKeyRevocationActionType&quot;: &quot;A String&quot;, # PostKeyRevocationActionType of the instance.(will be deprecated soon)
     &quot;privateIpv6GoogleAccess&quot;: &quot;A String&quot;, # The private IPv6 google access type for VMs. If not specified, use INHERIT_FROM_SUBNETWORK as default.
     &quot;reservationAffinity&quot;: { # Specifies the reservations that this instance can consume from. # Specifies the reservations that instances can consume from.
       &quot;consumeReservationType&quot;: &quot;A String&quot;, # Specifies the type of reservation from which this instance can consume resources: ANY_RESERVATION (default), SPECIFIC_RESERVATION, or NO_RESERVATION. See Consuming reserved instances for examples.
@@ -970,6 +972,7 @@
       &quot;properties&quot;: { # The instance properties for this instance template.
         &quot;advancedMachineFeatures&quot;: { # Specifies options for controlling advanced machine features. Options that would traditionally be configured in a BIOS belong here. Features that require operating system support may have corresponding entries in the GuestOsFeatures of an Image (e.g., whether or not the OS in the Image supports nested virtualization being enabled or disabled). # Controls for advanced machine-related behavior features.
           &quot;enableNestedVirtualization&quot;: True or False, # Whether to enable nested virtualization or not (default is false).
+          &quot;enableUefiNetworking&quot;: True or False, # Whether to enable UEFI networking for instance creation.
           &quot;numaNodeCount&quot;: 42, # The number of vNUMA nodes.
           &quot;threadsPerCore&quot;: 42, # The number of threads per physical core. To disable simultaneous multithreading (SMT) set this to 1. If unset, the maximum number of threads supported per core by the underlying processor is assumed.
           &quot;visibleCoreCount&quot;: 42, # The number of physical cores to expose to an instance. Multiply by the number of threads per core to compute the total number of virtual CPUs to expose to the instance. If unset, the number of cores is inferred from the instance&#x27;s nominal CPU count and the underlying platform&#x27;s SMT width.
@@ -985,10 +988,10 @@
             &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
             &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
             &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-              &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-              &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-              &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-              &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+              &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+              &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+              &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+              &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
               &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
             },
             &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -1030,18 +1033,18 @@
               ],
               &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
               &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-                &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-                &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-                &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-                &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+                &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+                &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+                &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+                &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
                 &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
               },
               &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
               &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-                &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-                &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-                &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-                &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+                &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+                &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+                &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+                &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
                 &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
               },
             },
@@ -1172,7 +1175,7 @@
           &quot;externalIpEgressBandwidthTier&quot;: &quot;A String&quot;,
           &quot;totalEgressBandwidthTier&quot;: &quot;A String&quot;,
         },
-        &quot;postKeyRevocationActionType&quot;: &quot;A String&quot;, # PostKeyRevocationActionType of the instance.
+        &quot;postKeyRevocationActionType&quot;: &quot;A String&quot;, # PostKeyRevocationActionType of the instance.(will be deprecated soon)
         &quot;privateIpv6GoogleAccess&quot;: &quot;A String&quot;, # The private IPv6 google access type for VMs. If not specified, use INHERIT_FROM_SUBNETWORK as default.
         &quot;reservationAffinity&quot;: { # Specifies the reservations that this instance can consume from. # Specifies the reservations that instances can consume from.
           &quot;consumeReservationType&quot;: &quot;A String&quot;, # Specifies the type of reservation from which this instance can consume resources: ANY_RESERVATION (default), SPECIFIC_RESERVATION, or NO_RESERVATION. See Consuming reserved instances for examples.
diff --git a/docs/dyn/compute_alpha.instances.html b/docs/dyn/compute_alpha.instances.html
index b4bb077..42f3566 100644
--- a/docs/dyn/compute_alpha.instances.html
+++ b/docs/dyn/compute_alpha.instances.html
@@ -82,7 +82,7 @@
 <p class="firstline">Adds existing resource policies to an instance. You can only add one policy right now which will be applied to this instance for scheduling live migrations.</p>
 <p class="toc_element">
   <code><a href="#aggregatedList">aggregatedList(project, filter=None, includeAllScopes=None, maxResults=None, orderBy=None, pageToken=None, returnPartialSuccess=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Retrieves aggregated list of all of the instances in your project across all regions and zones.</p>
+<p class="firstline">Retrieves an aggregated list of all of the instances in your project across all regions and zones. The performance of this method degrades when a filter is specified on a project that has a very large number of instances.</p>
 <p class="toc_element">
   <code><a href="#aggregatedList_next">aggregatedList_next(previous_request, previous_response)</a></code></p>
 <p class="firstline">Retrieves the next page of results.</p>
@@ -396,7 +396,7 @@
 
 <div class="method">
     <code class="details" id="aggregatedList">aggregatedList(project, filter=None, includeAllScopes=None, maxResults=None, orderBy=None, pageToken=None, returnPartialSuccess=None, x__xgafv=None)</code>
-  <pre>Retrieves aggregated list of all of the instances in your project across all regions and zones.
+  <pre>Retrieves an aggregated list of all of the instances in your project across all regions and zones. The performance of this method degrades when a filter is specified on a project that has a very large number of instances.
 
 Args:
   project: string, Project ID for this request. (required)
@@ -422,6 +422,7 @@
         { # Represents an Instance resource. An instance is a virtual machine that is hosted on Google Cloud Platform. For more information, read Virtual Machine Instances.
           &quot;advancedMachineFeatures&quot;: { # Specifies options for controlling advanced machine features. Options that would traditionally be configured in a BIOS belong here. Features that require operating system support may have corresponding entries in the GuestOsFeatures of an Image (e.g., whether or not the OS in the Image supports nested virtualization being enabled or disabled). # Controls for advanced machine-related behavior features.
             &quot;enableNestedVirtualization&quot;: True or False, # Whether to enable nested virtualization or not (default is false).
+            &quot;enableUefiNetworking&quot;: True or False, # Whether to enable UEFI networking for instance creation.
             &quot;numaNodeCount&quot;: 42, # The number of vNUMA nodes.
             &quot;threadsPerCore&quot;: 42, # The number of threads per physical core. To disable simultaneous multithreading (SMT) set this to 1. If unset, the maximum number of threads supported per core by the underlying processor is assumed.
             &quot;visibleCoreCount&quot;: 42, # The number of physical cores to expose to an instance. Multiply by the number of threads per core to compute the total number of virtual CPUs to expose to the instance. If unset, the number of cores is inferred from the instance&#x27;s nominal CPU count and the underlying platform&#x27;s SMT width.
@@ -440,10 +441,10 @@
               &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
               &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
               &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-                &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-                &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-                &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-                &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+                &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+                &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+                &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+                &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
                 &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
               },
               &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -485,18 +486,18 @@
                 ],
                 &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
                 &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-                  &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-                  &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-                  &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-                  &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+                  &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+                  &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+                  &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+                  &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
                   &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
                 },
                 &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
                 &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-                  &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-                  &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-                  &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-                  &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+                  &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+                  &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+                  &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+                  &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
                   &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
                 },
               },
@@ -553,10 +554,10 @@
           &quot;hostname&quot;: &quot;A String&quot;, # Specifies the hostname of the instance. The specified hostname must be RFC1035 compliant. If hostname is not specified, the default hostname is [INSTANCE_NAME].c.[PROJECT_ID].internal when using the global DNS, and [INSTANCE_NAME].[ZONE].c.[PROJECT_ID].internal when using zonal DNS.
           &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
           &quot;instanceEncryptionKey&quot;: { # Encrypts or decrypts data for an instance with a customer-supplied encryption key. If you are creating a new instance, this field encrypts the local SSD and in-memory contents of the instance using a key that you provide. If you are restarting an instance protected with a customer-supplied encryption key, you must provide the correct key in order to successfully restart the instance. If you do not provide an encryption key when creating the instance, then the local SSD and in-memory contents will be encrypted using an automatically generated key and you do not need to provide a key to start the instance later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt local SSDs and in-memory content in a managed instance group.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;kind&quot;: &quot;compute#instance&quot;, # [Output Only] Type of the resource. Always compute#instance for instances.
@@ -722,10 +723,10 @@
           },
           &quot;sourceMachineImage&quot;: &quot;A String&quot;, # Source machine image
           &quot;sourceMachineImageEncryptionKey&quot;: { # Source machine image encryption key when creating an instance from a machine image.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;startRestricted&quot;: True or False, # [Output Only] Whether a VM has been restricted for start because Compute Engine has detected suspicious activity.
@@ -737,7 +738,7 @@
               &quot;A String&quot;,
             ],
           },
-          &quot;upcomingMaintenance&quot;: { # Upcoming Maintenance notification information. # [Output Only] Specifies upcoming maintenance for the instance.
+          &quot;upcomingMaintenance&quot;: { # Upcoming Maintenance notification information. TODO(b/196881882) Deprecate this proto once it&#x27;s fully migrated to be under proto ResourceStatus.UpcomingMaintenance. # [Output Only] Specifies upcoming maintenance for the instance.
             &quot;date&quot;: &quot;A String&quot;, # [Output Only] The date when the maintenance will take place. This value is in RFC3339 text format. DEPRECATED: Use start_time_window instead.
             &quot;startTimeWindow&quot;: { # Represents a window of time using two timestamps: `earliest` and `latest`. This timestamp values are in RFC3339 text format. # [Output Only] The start time window of the maintenance disruption.
               &quot;earliest&quot;: &quot;A String&quot;,
@@ -810,10 +811,10 @@
   &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
   &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
   &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -855,18 +856,18 @@
     ],
     &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
     &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
       &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
     },
     &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
     &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
       &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
     },
   },
@@ -982,6 +983,7 @@
   &quot;instance&quot;: { # Represents an Instance resource. An instance is a virtual machine that is hosted on Google Cloud Platform. For more information, read Virtual Machine Instances. # DEPRECATED: Please use instance_properties instead.
     &quot;advancedMachineFeatures&quot;: { # Specifies options for controlling advanced machine features. Options that would traditionally be configured in a BIOS belong here. Features that require operating system support may have corresponding entries in the GuestOsFeatures of an Image (e.g., whether or not the OS in the Image supports nested virtualization being enabled or disabled). # Controls for advanced machine-related behavior features.
       &quot;enableNestedVirtualization&quot;: True or False, # Whether to enable nested virtualization or not (default is false).
+      &quot;enableUefiNetworking&quot;: True or False, # Whether to enable UEFI networking for instance creation.
       &quot;numaNodeCount&quot;: 42, # The number of vNUMA nodes.
       &quot;threadsPerCore&quot;: 42, # The number of threads per physical core. To disable simultaneous multithreading (SMT) set this to 1. If unset, the maximum number of threads supported per core by the underlying processor is assumed.
       &quot;visibleCoreCount&quot;: 42, # The number of physical cores to expose to an instance. Multiply by the number of threads per core to compute the total number of virtual CPUs to expose to the instance. If unset, the number of cores is inferred from the instance&#x27;s nominal CPU count and the underlying platform&#x27;s SMT width.
@@ -1000,10 +1002,10 @@
         &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
         &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
         &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -1045,18 +1047,18 @@
           ],
           &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
           &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
           &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
         },
@@ -1113,10 +1115,10 @@
     &quot;hostname&quot;: &quot;A String&quot;, # Specifies the hostname of the instance. The specified hostname must be RFC1035 compliant. If hostname is not specified, the default hostname is [INSTANCE_NAME].c.[PROJECT_ID].internal when using the global DNS, and [INSTANCE_NAME].[ZONE].c.[PROJECT_ID].internal when using zonal DNS.
     &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
     &quot;instanceEncryptionKey&quot;: { # Encrypts or decrypts data for an instance with a customer-supplied encryption key. If you are creating a new instance, this field encrypts the local SSD and in-memory contents of the instance using a key that you provide. If you are restarting an instance protected with a customer-supplied encryption key, you must provide the correct key in order to successfully restart the instance. If you do not provide an encryption key when creating the instance, then the local SSD and in-memory contents will be encrypted using an automatically generated key and you do not need to provide a key to start the instance later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt local SSDs and in-memory content in a managed instance group.
-      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
       &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
     },
     &quot;kind&quot;: &quot;compute#instance&quot;, # [Output Only] Type of the resource. Always compute#instance for instances.
@@ -1282,10 +1284,10 @@
     },
     &quot;sourceMachineImage&quot;: &quot;A String&quot;, # Source machine image
     &quot;sourceMachineImageEncryptionKey&quot;: { # Source machine image encryption key when creating an instance from a machine image.
-      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
       &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
     },
     &quot;startRestricted&quot;: True or False, # [Output Only] Whether a VM has been restricted for start because Compute Engine has detected suspicious activity.
@@ -1297,7 +1299,7 @@
         &quot;A String&quot;,
       ],
     },
-    &quot;upcomingMaintenance&quot;: { # Upcoming Maintenance notification information. # [Output Only] Specifies upcoming maintenance for the instance.
+    &quot;upcomingMaintenance&quot;: { # Upcoming Maintenance notification information. TODO(b/196881882) Deprecate this proto once it&#x27;s fully migrated to be under proto ResourceStatus.UpcomingMaintenance. # [Output Only] Specifies upcoming maintenance for the instance.
       &quot;date&quot;: &quot;A String&quot;, # [Output Only] The date when the maintenance will take place. This value is in RFC3339 text format. DEPRECATED: Use start_time_window instead.
       &quot;startTimeWindow&quot;: { # Represents a window of time using two timestamps: `earliest` and `latest`. This timestamp values are in RFC3339 text format. # [Output Only] The start time window of the maintenance disruption.
         &quot;earliest&quot;: &quot;A String&quot;,
@@ -1311,6 +1313,7 @@
   &quot;instanceProperties&quot;: { # The instance properties defining the VM instances to be created. Required if sourceInstanceTemplate is not provided.
     &quot;advancedMachineFeatures&quot;: { # Specifies options for controlling advanced machine features. Options that would traditionally be configured in a BIOS belong here. Features that require operating system support may have corresponding entries in the GuestOsFeatures of an Image (e.g., whether or not the OS in the Image supports nested virtualization being enabled or disabled). # Controls for advanced machine-related behavior features.
       &quot;enableNestedVirtualization&quot;: True or False, # Whether to enable nested virtualization or not (default is false).
+      &quot;enableUefiNetworking&quot;: True or False, # Whether to enable UEFI networking for instance creation.
       &quot;numaNodeCount&quot;: 42, # The number of vNUMA nodes.
       &quot;threadsPerCore&quot;: 42, # The number of threads per physical core. To disable simultaneous multithreading (SMT) set this to 1. If unset, the maximum number of threads supported per core by the underlying processor is assumed.
       &quot;visibleCoreCount&quot;: 42, # The number of physical cores to expose to an instance. Multiply by the number of threads per core to compute the total number of virtual CPUs to expose to the instance. If unset, the number of cores is inferred from the instance&#x27;s nominal CPU count and the underlying platform&#x27;s SMT width.
@@ -1326,10 +1329,10 @@
         &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
         &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
         &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -1371,18 +1374,18 @@
           ],
           &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
           &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
           &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
         },
@@ -1513,7 +1516,7 @@
       &quot;externalIpEgressBandwidthTier&quot;: &quot;A String&quot;,
       &quot;totalEgressBandwidthTier&quot;: &quot;A String&quot;,
     },
-    &quot;postKeyRevocationActionType&quot;: &quot;A String&quot;, # PostKeyRevocationActionType of the instance.
+    &quot;postKeyRevocationActionType&quot;: &quot;A String&quot;, # PostKeyRevocationActionType of the instance.(will be deprecated soon)
     &quot;privateIpv6GoogleAccess&quot;: &quot;A String&quot;, # The private IPv6 google access type for VMs. If not specified, use INHERIT_FROM_SUBNETWORK as default.
     &quot;reservationAffinity&quot;: { # Specifies the reservations that this instance can consume from. # Specifies the reservations that instances can consume from.
       &quot;consumeReservationType&quot;: &quot;A String&quot;, # Specifies the type of reservation from which this instance can consume resources: ANY_RESERVATION (default), SPECIFIC_RESERVATION, or NO_RESERVATION. See Consuming reserved instances for examples.
@@ -1875,6 +1878,7 @@
     { # Represents an Instance resource. An instance is a virtual machine that is hosted on Google Cloud Platform. For more information, read Virtual Machine Instances.
   &quot;advancedMachineFeatures&quot;: { # Specifies options for controlling advanced machine features. Options that would traditionally be configured in a BIOS belong here. Features that require operating system support may have corresponding entries in the GuestOsFeatures of an Image (e.g., whether or not the OS in the Image supports nested virtualization being enabled or disabled). # Controls for advanced machine-related behavior features.
     &quot;enableNestedVirtualization&quot;: True or False, # Whether to enable nested virtualization or not (default is false).
+    &quot;enableUefiNetworking&quot;: True or False, # Whether to enable UEFI networking for instance creation.
     &quot;numaNodeCount&quot;: 42, # The number of vNUMA nodes.
     &quot;threadsPerCore&quot;: 42, # The number of threads per physical core. To disable simultaneous multithreading (SMT) set this to 1. If unset, the maximum number of threads supported per core by the underlying processor is assumed.
     &quot;visibleCoreCount&quot;: 42, # The number of physical cores to expose to an instance. Multiply by the number of threads per core to compute the total number of virtual CPUs to expose to the instance. If unset, the number of cores is inferred from the instance&#x27;s nominal CPU count and the underlying platform&#x27;s SMT width.
@@ -1893,10 +1897,10 @@
       &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
       &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
       &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -1938,18 +1942,18 @@
         ],
         &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
         &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
         &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
       },
@@ -2006,10 +2010,10 @@
   &quot;hostname&quot;: &quot;A String&quot;, # Specifies the hostname of the instance. The specified hostname must be RFC1035 compliant. If hostname is not specified, the default hostname is [INSTANCE_NAME].c.[PROJECT_ID].internal when using the global DNS, and [INSTANCE_NAME].[ZONE].c.[PROJECT_ID].internal when using zonal DNS.
   &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
   &quot;instanceEncryptionKey&quot;: { # Encrypts or decrypts data for an instance with a customer-supplied encryption key. If you are creating a new instance, this field encrypts the local SSD and in-memory contents of the instance using a key that you provide. If you are restarting an instance protected with a customer-supplied encryption key, you must provide the correct key in order to successfully restart the instance. If you do not provide an encryption key when creating the instance, then the local SSD and in-memory contents will be encrypted using an automatically generated key and you do not need to provide a key to start the instance later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt local SSDs and in-memory content in a managed instance group.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;kind&quot;: &quot;compute#instance&quot;, # [Output Only] Type of the resource. Always compute#instance for instances.
@@ -2175,10 +2179,10 @@
   },
   &quot;sourceMachineImage&quot;: &quot;A String&quot;, # Source machine image
   &quot;sourceMachineImageEncryptionKey&quot;: { # Source machine image encryption key when creating an instance from a machine image.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;startRestricted&quot;: True or False, # [Output Only] Whether a VM has been restricted for start because Compute Engine has detected suspicious activity.
@@ -2190,7 +2194,7 @@
       &quot;A String&quot;,
     ],
   },
-  &quot;upcomingMaintenance&quot;: { # Upcoming Maintenance notification information. # [Output Only] Specifies upcoming maintenance for the instance.
+  &quot;upcomingMaintenance&quot;: { # Upcoming Maintenance notification information. TODO(b/196881882) Deprecate this proto once it&#x27;s fully migrated to be under proto ResourceStatus.UpcomingMaintenance. # [Output Only] Specifies upcoming maintenance for the instance.
     &quot;date&quot;: &quot;A String&quot;, # [Output Only] The date when the maintenance will take place. This value is in RFC3339 text format. DEPRECATED: Use start_time_window instead.
     &quot;startTimeWindow&quot;: { # Represents a window of time using two timestamps: `earliest` and `latest`. This timestamp values are in RFC3339 text format. # [Output Only] The start time window of the maintenance disruption.
       &quot;earliest&quot;: &quot;A String&quot;,
@@ -2313,7 +2317,7 @@
         &quot;enable&quot;: True or False, # This field denotes whether to enable logging for a particular firewall rule.
         &quot;metadata&quot;: &quot;A String&quot;, # This field can only be specified for a particular firewall rule if logging is enabled for that rule. This field denotes whether to include or exclude metadata for firewall logs.
       },
-      &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+      &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
       &quot;network&quot;: &quot;A String&quot;, # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
       &quot;priority&quot;: 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
@@ -2692,6 +2696,7 @@
 { # Represents an Instance resource. An instance is a virtual machine that is hosted on Google Cloud Platform. For more information, read Virtual Machine Instances.
   &quot;advancedMachineFeatures&quot;: { # Specifies options for controlling advanced machine features. Options that would traditionally be configured in a BIOS belong here. Features that require operating system support may have corresponding entries in the GuestOsFeatures of an Image (e.g., whether or not the OS in the Image supports nested virtualization being enabled or disabled). # Controls for advanced machine-related behavior features.
     &quot;enableNestedVirtualization&quot;: True or False, # Whether to enable nested virtualization or not (default is false).
+    &quot;enableUefiNetworking&quot;: True or False, # Whether to enable UEFI networking for instance creation.
     &quot;numaNodeCount&quot;: 42, # The number of vNUMA nodes.
     &quot;threadsPerCore&quot;: 42, # The number of threads per physical core. To disable simultaneous multithreading (SMT) set this to 1. If unset, the maximum number of threads supported per core by the underlying processor is assumed.
     &quot;visibleCoreCount&quot;: 42, # The number of physical cores to expose to an instance. Multiply by the number of threads per core to compute the total number of virtual CPUs to expose to the instance. If unset, the number of cores is inferred from the instance&#x27;s nominal CPU count and the underlying platform&#x27;s SMT width.
@@ -2710,10 +2715,10 @@
       &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
       &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
       &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -2755,18 +2760,18 @@
         ],
         &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
         &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
         &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
       },
@@ -2823,10 +2828,10 @@
   &quot;hostname&quot;: &quot;A String&quot;, # Specifies the hostname of the instance. The specified hostname must be RFC1035 compliant. If hostname is not specified, the default hostname is [INSTANCE_NAME].c.[PROJECT_ID].internal when using the global DNS, and [INSTANCE_NAME].[ZONE].c.[PROJECT_ID].internal when using zonal DNS.
   &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
   &quot;instanceEncryptionKey&quot;: { # Encrypts or decrypts data for an instance with a customer-supplied encryption key. If you are creating a new instance, this field encrypts the local SSD and in-memory contents of the instance using a key that you provide. If you are restarting an instance protected with a customer-supplied encryption key, you must provide the correct key in order to successfully restart the instance. If you do not provide an encryption key when creating the instance, then the local SSD and in-memory contents will be encrypted using an automatically generated key and you do not need to provide a key to start the instance later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt local SSDs and in-memory content in a managed instance group.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;kind&quot;: &quot;compute#instance&quot;, # [Output Only] Type of the resource. Always compute#instance for instances.
@@ -2992,10 +2997,10 @@
   },
   &quot;sourceMachineImage&quot;: &quot;A String&quot;, # Source machine image
   &quot;sourceMachineImageEncryptionKey&quot;: { # Source machine image encryption key when creating an instance from a machine image.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;startRestricted&quot;: True or False, # [Output Only] Whether a VM has been restricted for start because Compute Engine has detected suspicious activity.
@@ -3007,7 +3012,7 @@
       &quot;A String&quot;,
     ],
   },
-  &quot;upcomingMaintenance&quot;: { # Upcoming Maintenance notification information. # [Output Only] Specifies upcoming maintenance for the instance.
+  &quot;upcomingMaintenance&quot;: { # Upcoming Maintenance notification information. TODO(b/196881882) Deprecate this proto once it&#x27;s fully migrated to be under proto ResourceStatus.UpcomingMaintenance. # [Output Only] Specifies upcoming maintenance for the instance.
     &quot;date&quot;: &quot;A String&quot;, # [Output Only] The date when the maintenance will take place. This value is in RFC3339 text format. DEPRECATED: Use start_time_window instead.
     &quot;startTimeWindow&quot;: { # Represents a window of time using two timestamps: `earliest` and `latest`. This timestamp values are in RFC3339 text format. # [Output Only] The start time window of the maintenance disruption.
       &quot;earliest&quot;: &quot;A String&quot;,
@@ -3104,6 +3109,7 @@
     { # Represents an Instance resource. An instance is a virtual machine that is hosted on Google Cloud Platform. For more information, read Virtual Machine Instances.
       &quot;advancedMachineFeatures&quot;: { # Specifies options for controlling advanced machine features. Options that would traditionally be configured in a BIOS belong here. Features that require operating system support may have corresponding entries in the GuestOsFeatures of an Image (e.g., whether or not the OS in the Image supports nested virtualization being enabled or disabled). # Controls for advanced machine-related behavior features.
         &quot;enableNestedVirtualization&quot;: True or False, # Whether to enable nested virtualization or not (default is false).
+        &quot;enableUefiNetworking&quot;: True or False, # Whether to enable UEFI networking for instance creation.
         &quot;numaNodeCount&quot;: 42, # The number of vNUMA nodes.
         &quot;threadsPerCore&quot;: 42, # The number of threads per physical core. To disable simultaneous multithreading (SMT) set this to 1. If unset, the maximum number of threads supported per core by the underlying processor is assumed.
         &quot;visibleCoreCount&quot;: 42, # The number of physical cores to expose to an instance. Multiply by the number of threads per core to compute the total number of virtual CPUs to expose to the instance. If unset, the number of cores is inferred from the instance&#x27;s nominal CPU count and the underlying platform&#x27;s SMT width.
@@ -3122,10 +3128,10 @@
           &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
           &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
           &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -3167,18 +3173,18 @@
             ],
             &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
             &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-              &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-              &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-              &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-              &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+              &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+              &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+              &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+              &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
               &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
             },
             &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
             &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-              &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-              &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-              &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-              &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+              &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+              &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+              &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+              &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
               &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
             },
           },
@@ -3235,10 +3241,10 @@
       &quot;hostname&quot;: &quot;A String&quot;, # Specifies the hostname of the instance. The specified hostname must be RFC1035 compliant. If hostname is not specified, the default hostname is [INSTANCE_NAME].c.[PROJECT_ID].internal when using the global DNS, and [INSTANCE_NAME].[ZONE].c.[PROJECT_ID].internal when using zonal DNS.
       &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
       &quot;instanceEncryptionKey&quot;: { # Encrypts or decrypts data for an instance with a customer-supplied encryption key. If you are creating a new instance, this field encrypts the local SSD and in-memory contents of the instance using a key that you provide. If you are restarting an instance protected with a customer-supplied encryption key, you must provide the correct key in order to successfully restart the instance. If you do not provide an encryption key when creating the instance, then the local SSD and in-memory contents will be encrypted using an automatically generated key and you do not need to provide a key to start the instance later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt local SSDs and in-memory content in a managed instance group.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;kind&quot;: &quot;compute#instance&quot;, # [Output Only] Type of the resource. Always compute#instance for instances.
@@ -3404,10 +3410,10 @@
       },
       &quot;sourceMachineImage&quot;: &quot;A String&quot;, # Source machine image
       &quot;sourceMachineImageEncryptionKey&quot;: { # Source machine image encryption key when creating an instance from a machine image.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;startRestricted&quot;: True or False, # [Output Only] Whether a VM has been restricted for start because Compute Engine has detected suspicious activity.
@@ -3419,7 +3425,7 @@
           &quot;A String&quot;,
         ],
       },
-      &quot;upcomingMaintenance&quot;: { # Upcoming Maintenance notification information. # [Output Only] Specifies upcoming maintenance for the instance.
+      &quot;upcomingMaintenance&quot;: { # Upcoming Maintenance notification information. TODO(b/196881882) Deprecate this proto once it&#x27;s fully migrated to be under proto ResourceStatus.UpcomingMaintenance. # [Output Only] Specifies upcoming maintenance for the instance.
         &quot;date&quot;: &quot;A String&quot;, # [Output Only] The date when the maintenance will take place. This value is in RFC3339 text format. DEPRECATED: Use start_time_window instead.
         &quot;startTimeWindow&quot;: { # Represents a window of time using two timestamps: `earliest` and `latest`. This timestamp values are in RFC3339 text format. # [Output Only] The start time window of the maintenance disruption.
           &quot;earliest&quot;: &quot;A String&quot;,
@@ -3741,20 +3747,20 @@
   &quot;disks&quot;: [ # Array of disks associated with this instance that are protected with a customer-supplied encryption key. In order to resume the instance, the disk url and its corresponding key must be provided. If the disk is not protected with a customer-supplied encryption key it should not be specified.
     {
       &quot;diskEncryptionKey&quot;: { # Decrypts data associated with the disk with a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
-      &quot;source&quot;: &quot;A String&quot;, # Specifies a valid partial or full URL to an existing Persistent Disk resource. This field is only applicable for persistent disks.
+      &quot;source&quot;: &quot;A String&quot;, # Specifies a valid partial or full URL to an existing Persistent Disk resource. This field is only applicable for persistent disks. For example: &quot;source&quot;: &quot;/compute/v1/projects/project_id/zones/zone/disks/ disk_name
     },
   ],
   &quot;instanceEncryptionKey&quot;: { # Decrypts data associated with an instance that is protected with a customer-supplied encryption key. If the instance you are starting is protected with a customer-supplied encryption key, the correct key must be provided otherwise the instance resume will not succeed.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
 }
@@ -5156,20 +5162,20 @@
   &quot;disks&quot;: [ # Array of disks associated with this instance that are protected with a customer-supplied encryption key. In order to start the instance, the disk url and its corresponding key must be provided. If the disk is not protected with a customer-supplied encryption key it should not be specified.
     {
       &quot;diskEncryptionKey&quot;: { # Decrypts data associated with the disk with a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
-      &quot;source&quot;: &quot;A String&quot;, # Specifies a valid partial or full URL to an existing Persistent Disk resource. This field is only applicable for persistent disks.
+      &quot;source&quot;: &quot;A String&quot;, # Specifies a valid partial or full URL to an existing Persistent Disk resource. This field is only applicable for persistent disks. For example: &quot;source&quot;: &quot;/compute/v1/projects/project_id/zones/zone/disks/ disk_name
     },
   ],
   &quot;instanceEncryptionKey&quot;: { # Decrypts data associated with an instance that is protected with a customer-supplied encryption key. If the instance you are starting is protected with a customer-supplied encryption key, the correct key must be provided otherwise the instance start will not succeed.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
 }
@@ -5409,6 +5415,7 @@
 { # Represents an Instance resource. An instance is a virtual machine that is hosted on Google Cloud Platform. For more information, read Virtual Machine Instances.
   &quot;advancedMachineFeatures&quot;: { # Specifies options for controlling advanced machine features. Options that would traditionally be configured in a BIOS belong here. Features that require operating system support may have corresponding entries in the GuestOsFeatures of an Image (e.g., whether or not the OS in the Image supports nested virtualization being enabled or disabled). # Controls for advanced machine-related behavior features.
     &quot;enableNestedVirtualization&quot;: True or False, # Whether to enable nested virtualization or not (default is false).
+    &quot;enableUefiNetworking&quot;: True or False, # Whether to enable UEFI networking for instance creation.
     &quot;numaNodeCount&quot;: 42, # The number of vNUMA nodes.
     &quot;threadsPerCore&quot;: 42, # The number of threads per physical core. To disable simultaneous multithreading (SMT) set this to 1. If unset, the maximum number of threads supported per core by the underlying processor is assumed.
     &quot;visibleCoreCount&quot;: 42, # The number of physical cores to expose to an instance. Multiply by the number of threads per core to compute the total number of virtual CPUs to expose to the instance. If unset, the number of cores is inferred from the instance&#x27;s nominal CPU count and the underlying platform&#x27;s SMT width.
@@ -5427,10 +5434,10 @@
       &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
       &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
       &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -5472,18 +5479,18 @@
         ],
         &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
         &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
         &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
       },
@@ -5540,10 +5547,10 @@
   &quot;hostname&quot;: &quot;A String&quot;, # Specifies the hostname of the instance. The specified hostname must be RFC1035 compliant. If hostname is not specified, the default hostname is [INSTANCE_NAME].c.[PROJECT_ID].internal when using the global DNS, and [INSTANCE_NAME].[ZONE].c.[PROJECT_ID].internal when using zonal DNS.
   &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
   &quot;instanceEncryptionKey&quot;: { # Encrypts or decrypts data for an instance with a customer-supplied encryption key. If you are creating a new instance, this field encrypts the local SSD and in-memory contents of the instance using a key that you provide. If you are restarting an instance protected with a customer-supplied encryption key, you must provide the correct key in order to successfully restart the instance. If you do not provide an encryption key when creating the instance, then the local SSD and in-memory contents will be encrypted using an automatically generated key and you do not need to provide a key to start the instance later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt local SSDs and in-memory content in a managed instance group.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;kind&quot;: &quot;compute#instance&quot;, # [Output Only] Type of the resource. Always compute#instance for instances.
@@ -5709,10 +5716,10 @@
   },
   &quot;sourceMachineImage&quot;: &quot;A String&quot;, # Source machine image
   &quot;sourceMachineImageEncryptionKey&quot;: { # Source machine image encryption key when creating an instance from a machine image.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;startRestricted&quot;: True or False, # [Output Only] Whether a VM has been restricted for start because Compute Engine has detected suspicious activity.
@@ -5724,7 +5731,7 @@
       &quot;A String&quot;,
     ],
   },
-  &quot;upcomingMaintenance&quot;: { # Upcoming Maintenance notification information. # [Output Only] Specifies upcoming maintenance for the instance.
+  &quot;upcomingMaintenance&quot;: { # Upcoming Maintenance notification information. TODO(b/196881882) Deprecate this proto once it&#x27;s fully migrated to be under proto ResourceStatus.UpcomingMaintenance. # [Output Only] Specifies upcoming maintenance for the instance.
     &quot;date&quot;: &quot;A String&quot;, # [Output Only] The date when the maintenance will take place. This value is in RFC3339 text format. DEPRECATED: Use start_time_window instead.
     &quot;startTimeWindow&quot;: { # Represents a window of time using two timestamps: `earliest` and `latest`. This timestamp values are in RFC3339 text format. # [Output Only] The start time window of the maintenance disruption.
       &quot;earliest&quot;: &quot;A String&quot;,
diff --git a/docs/dyn/compute_alpha.instantSnapshots.html b/docs/dyn/compute_alpha.instantSnapshots.html
index 9b2d35a..93be904 100644
--- a/docs/dyn/compute_alpha.instantSnapshots.html
+++ b/docs/dyn/compute_alpha.instantSnapshots.html
@@ -194,10 +194,10 @@
     &quot;baseInstantSnapshot&quot;: &quot;A String&quot;, # An optional base instant snapshot that this resource is compared against. If not specified, all blocks of this resource are exported. The base instant snapshot and this resource must be created from the same disk. The base instant snapshot must be created earlier in time than this resource.
     &quot;bucketName&quot;: &quot;A String&quot;, # The name of an existing bucket in Cloud Storage where the changed blocks will be stored. The Google Service Account must have read and write access to this bucket. The bucket has to be in the same region as this resource.
     &quot;encryptionKey&quot;: { # Encryption key used to encrypt the instant snapshot.
-      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
       &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
     },
     &quot;objectName&quot;: &quot;A String&quot;, # Name of the output Bigstore object storing the changed blocks. Object name must be less than 1024 bytes in length.
diff --git a/docs/dyn/compute_alpha.machineImages.html b/docs/dyn/compute_alpha.machineImages.html
index 58240bd..bc01707 100644
--- a/docs/dyn/compute_alpha.machineImages.html
+++ b/docs/dyn/compute_alpha.machineImages.html
@@ -193,10 +193,10 @@
   &quot;id&quot;: &quot;A String&quot;, # [Output Only] A unique identifier for this machine image. The server defines this identifier.
   &quot;kind&quot;: &quot;compute#machineImage&quot;, # [Output Only] The resource type, which is always compute#machineImage for machine image.
   &quot;machineImageEncryptionKey&quot;: { # Encrypts the machine image using a customer-supplied encryption key. After you encrypt a machine image using a customer-supplied key, you must provide the same key if you use the machine image later. For example, you must provide the encryption key when you create an instance from the encrypted machine image in a future request. Customer-supplied encryption keys do not protect access to metadata of the machine image. If you do not provide an encryption key when creating the machine image, then the machine image will be encrypted using an automatically generated key and you do not need to provide a key to use the machine image later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
@@ -206,10 +206,10 @@
   &quot;sourceDiskEncryptionKeys&quot;: [ # [Input Only] The customer-supplied encryption key of the disks attached to the source instance. Required if the source disk is protected by a customer-supplied encryption key.
     {
       &quot;diskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceDisk&quot;: &quot;A String&quot;, # URL of the disk attached to the source instance. This can be a full or valid partial URL. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /disks/disk - projects/project/zones/zone/disks/disk - zones/zone/disks/disk
@@ -226,10 +226,10 @@
         &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
         &quot;deviceName&quot;: &quot;A String&quot;, # Specifies the name of the disk attached to the source instance.
         &quot;diskEncryptionKey&quot;: { # The encryption key for the disk.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in base-2 GB.
@@ -502,10 +502,10 @@
   &quot;id&quot;: &quot;A String&quot;, # [Output Only] A unique identifier for this machine image. The server defines this identifier.
   &quot;kind&quot;: &quot;compute#machineImage&quot;, # [Output Only] The resource type, which is always compute#machineImage for machine image.
   &quot;machineImageEncryptionKey&quot;: { # Encrypts the machine image using a customer-supplied encryption key. After you encrypt a machine image using a customer-supplied key, you must provide the same key if you use the machine image later. For example, you must provide the encryption key when you create an instance from the encrypted machine image in a future request. Customer-supplied encryption keys do not protect access to metadata of the machine image. If you do not provide an encryption key when creating the machine image, then the machine image will be encrypted using an automatically generated key and you do not need to provide a key to use the machine image later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
@@ -515,10 +515,10 @@
   &quot;sourceDiskEncryptionKeys&quot;: [ # [Input Only] The customer-supplied encryption key of the disks attached to the source instance. Required if the source disk is protected by a customer-supplied encryption key.
     {
       &quot;diskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceDisk&quot;: &quot;A String&quot;, # URL of the disk attached to the source instance. This can be a full or valid partial URL. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /disks/disk - projects/project/zones/zone/disks/disk - zones/zone/disks/disk
@@ -535,10 +535,10 @@
         &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
         &quot;deviceName&quot;: &quot;A String&quot;, # Specifies the name of the disk attached to the source instance.
         &quot;diskEncryptionKey&quot;: { # The encryption key for the disk.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in base-2 GB.
@@ -777,10 +777,10 @@
       &quot;id&quot;: &quot;A String&quot;, # [Output Only] A unique identifier for this machine image. The server defines this identifier.
       &quot;kind&quot;: &quot;compute#machineImage&quot;, # [Output Only] The resource type, which is always compute#machineImage for machine image.
       &quot;machineImageEncryptionKey&quot;: { # Encrypts the machine image using a customer-supplied encryption key. After you encrypt a machine image using a customer-supplied key, you must provide the same key if you use the machine image later. For example, you must provide the encryption key when you create an instance from the encrypted machine image in a future request. Customer-supplied encryption keys do not protect access to metadata of the machine image. If you do not provide an encryption key when creating the machine image, then the machine image will be encrypted using an automatically generated key and you do not need to provide a key to use the machine image later.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
@@ -790,10 +790,10 @@
       &quot;sourceDiskEncryptionKeys&quot;: [ # [Input Only] The customer-supplied encryption key of the disks attached to the source instance. Required if the source disk is protected by a customer-supplied encryption key.
         {
           &quot;diskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;sourceDisk&quot;: &quot;A String&quot;, # URL of the disk attached to the source instance. This can be a full or valid partial URL. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /disks/disk - projects/project/zones/zone/disks/disk - zones/zone/disks/disk
@@ -810,10 +810,10 @@
             &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
             &quot;deviceName&quot;: &quot;A String&quot;, # Specifies the name of the disk attached to the source instance.
             &quot;diskEncryptionKey&quot;: { # The encryption key for the disk.
-              &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-              &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-              &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-              &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+              &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+              &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+              &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+              &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
               &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
             },
             &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in base-2 GB.
diff --git a/docs/dyn/compute_alpha.networks.html b/docs/dyn/compute_alpha.networks.html
index f2566f8..dee937c 100644
--- a/docs/dyn/compute_alpha.networks.html
+++ b/docs/dyn/compute_alpha.networks.html
@@ -310,12 +310,15 @@
   &quot;autoCreateSubnetworks&quot;: True or False, # Must be set to create a VPC network. If not set, a legacy network is created. When set to true, the VPC network is created in auto mode. When set to false, the VPC network is created in custom mode. An auto mode VPC network starts with one subnet per region. Each subnet has a predetermined range as described in Auto mode VPC network IP ranges. For custom mode VPC networks, you can add subnets using the subnetworks insert method.
   &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
   &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this field when you create the resource.
+  &quot;enableUlaInternalIpv6&quot;: True or False, # Enable ULA internal ipv6 on this network. Enabling this feature will assign a /48 from google defined ULA prefix fd20::/20. .
   &quot;firewallPolicy&quot;: &quot;A String&quot;, # [Output Only] URL of the firewall policy the network is associated with.
   &quot;gatewayIPv4&quot;: &quot;A String&quot;, # [Output Only] The gateway address for default routing out of the network, selected by GCP.
   &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
+  &quot;internalIpv6Range&quot;: &quot;A String&quot;, # When enabling ula internal ipv6, caller optionally can specify the /48 range they want from the google defined ULA prefix fd20::/20. The input must be a valid /48 ULA IPv6 address and must be within the fd20::/20. Operation will fail if the speficied /48 is already in used by another resource. If the field is not speficied, then a /48 range will be randomly allocated from fd20::/20 and returned via this field. .
   &quot;kind&quot;: &quot;compute#network&quot;, # [Output Only] Type of the resource. Always compute#network for networks.
   &quot;mtu&quot;: 42, # Maximum Transmission Unit in bytes. The minimum value for this field is 1460 and the maximum value is 1500 bytes. If unspecified, defaults to 1460.
   &quot;name&quot;: &quot;A String&quot;, # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+  &quot;networkFirewallPolicyEnforcementOrder&quot;: &quot;A String&quot;,
   &quot;peerings&quot;: [ # [Output Only] A list of network peerings for the resource.
     { # A network peering attached to a network resource. The message includes the peering name, peer network, peering state, and a flag indicating whether Google Compute Engine should automatically create routes for the peering.
       &quot;advertisePeerSubnetsViaRouters&quot;: True or False, # Whether Cloud Routers in this network can automatically advertise subnets from the peer network.
@@ -451,7 +454,7 @@
         &quot;enable&quot;: True or False, # This field denotes whether to enable logging for a particular firewall rule.
         &quot;metadata&quot;: &quot;A String&quot;, # This field can only be specified for a particular firewall rule if logging is enabled for that rule. This field denotes whether to include or exclude metadata for firewall logs.
       },
-      &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+      &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
       &quot;network&quot;: &quot;A String&quot;, # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
       &quot;priority&quot;: 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
@@ -575,12 +578,15 @@
   &quot;autoCreateSubnetworks&quot;: True or False, # Must be set to create a VPC network. If not set, a legacy network is created. When set to true, the VPC network is created in auto mode. When set to false, the VPC network is created in custom mode. An auto mode VPC network starts with one subnet per region. Each subnet has a predetermined range as described in Auto mode VPC network IP ranges. For custom mode VPC networks, you can add subnets using the subnetworks insert method.
   &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
   &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this field when you create the resource.
+  &quot;enableUlaInternalIpv6&quot;: True or False, # Enable ULA internal ipv6 on this network. Enabling this feature will assign a /48 from google defined ULA prefix fd20::/20. .
   &quot;firewallPolicy&quot;: &quot;A String&quot;, # [Output Only] URL of the firewall policy the network is associated with.
   &quot;gatewayIPv4&quot;: &quot;A String&quot;, # [Output Only] The gateway address for default routing out of the network, selected by GCP.
   &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
+  &quot;internalIpv6Range&quot;: &quot;A String&quot;, # When enabling ula internal ipv6, caller optionally can specify the /48 range they want from the google defined ULA prefix fd20::/20. The input must be a valid /48 ULA IPv6 address and must be within the fd20::/20. Operation will fail if the speficied /48 is already in used by another resource. If the field is not speficied, then a /48 range will be randomly allocated from fd20::/20 and returned via this field. .
   &quot;kind&quot;: &quot;compute#network&quot;, # [Output Only] Type of the resource. Always compute#network for networks.
   &quot;mtu&quot;: 42, # Maximum Transmission Unit in bytes. The minimum value for this field is 1460 and the maximum value is 1500 bytes. If unspecified, defaults to 1460.
   &quot;name&quot;: &quot;A String&quot;, # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+  &quot;networkFirewallPolicyEnforcementOrder&quot;: &quot;A String&quot;,
   &quot;peerings&quot;: [ # [Output Only] A list of network peerings for the resource.
     { # A network peering attached to a network resource. The message includes the peering name, peer network, peering state, and a flag indicating whether Google Compute Engine should automatically create routes for the peering.
       &quot;advertisePeerSubnetsViaRouters&quot;: True or False, # Whether Cloud Routers in this network can automatically advertise subnets from the peer network.
@@ -691,12 +697,15 @@
       &quot;autoCreateSubnetworks&quot;: True or False, # Must be set to create a VPC network. If not set, a legacy network is created. When set to true, the VPC network is created in auto mode. When set to false, the VPC network is created in custom mode. An auto mode VPC network starts with one subnet per region. Each subnet has a predetermined range as described in Auto mode VPC network IP ranges. For custom mode VPC networks, you can add subnets using the subnetworks insert method.
       &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
       &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this field when you create the resource.
+      &quot;enableUlaInternalIpv6&quot;: True or False, # Enable ULA internal ipv6 on this network. Enabling this feature will assign a /48 from google defined ULA prefix fd20::/20. .
       &quot;firewallPolicy&quot;: &quot;A String&quot;, # [Output Only] URL of the firewall policy the network is associated with.
       &quot;gatewayIPv4&quot;: &quot;A String&quot;, # [Output Only] The gateway address for default routing out of the network, selected by GCP.
       &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
+      &quot;internalIpv6Range&quot;: &quot;A String&quot;, # When enabling ula internal ipv6, caller optionally can specify the /48 range they want from the google defined ULA prefix fd20::/20. The input must be a valid /48 ULA IPv6 address and must be within the fd20::/20. Operation will fail if the speficied /48 is already in used by another resource. If the field is not speficied, then a /48 range will be randomly allocated from fd20::/20 and returned via this field. .
       &quot;kind&quot;: &quot;compute#network&quot;, # [Output Only] Type of the resource. Always compute#network for networks.
       &quot;mtu&quot;: 42, # Maximum Transmission Unit in bytes. The minimum value for this field is 1460 and the maximum value is 1500 bytes. If unspecified, defaults to 1460.
       &quot;name&quot;: &quot;A String&quot;, # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+      &quot;networkFirewallPolicyEnforcementOrder&quot;: &quot;A String&quot;,
       &quot;peerings&quot;: [ # [Output Only] A list of network peerings for the resource.
         { # A network peering attached to a network resource. The message includes the peering name, peer network, peering state, and a flag indicating whether Google Compute Engine should automatically create routes for the peering.
           &quot;advertisePeerSubnetsViaRouters&quot;: True or False, # Whether Cloud Routers in this network can automatically advertise subnets from the peer network.
@@ -963,12 +972,15 @@
   &quot;autoCreateSubnetworks&quot;: True or False, # Must be set to create a VPC network. If not set, a legacy network is created. When set to true, the VPC network is created in auto mode. When set to false, the VPC network is created in custom mode. An auto mode VPC network starts with one subnet per region. Each subnet has a predetermined range as described in Auto mode VPC network IP ranges. For custom mode VPC networks, you can add subnets using the subnetworks insert method.
   &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
   &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this field when you create the resource.
+  &quot;enableUlaInternalIpv6&quot;: True or False, # Enable ULA internal ipv6 on this network. Enabling this feature will assign a /48 from google defined ULA prefix fd20::/20. .
   &quot;firewallPolicy&quot;: &quot;A String&quot;, # [Output Only] URL of the firewall policy the network is associated with.
   &quot;gatewayIPv4&quot;: &quot;A String&quot;, # [Output Only] The gateway address for default routing out of the network, selected by GCP.
   &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
+  &quot;internalIpv6Range&quot;: &quot;A String&quot;, # When enabling ula internal ipv6, caller optionally can specify the /48 range they want from the google defined ULA prefix fd20::/20. The input must be a valid /48 ULA IPv6 address and must be within the fd20::/20. Operation will fail if the speficied /48 is already in used by another resource. If the field is not speficied, then a /48 range will be randomly allocated from fd20::/20 and returned via this field. .
   &quot;kind&quot;: &quot;compute#network&quot;, # [Output Only] Type of the resource. Always compute#network for networks.
   &quot;mtu&quot;: 42, # Maximum Transmission Unit in bytes. The minimum value for this field is 1460 and the maximum value is 1500 bytes. If unspecified, defaults to 1460.
   &quot;name&quot;: &quot;A String&quot;, # Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+  &quot;networkFirewallPolicyEnforcementOrder&quot;: &quot;A String&quot;,
   &quot;peerings&quot;: [ # [Output Only] A list of network peerings for the resource.
     { # A network peering attached to a network resource. The message includes the peering name, peer network, peering state, and a flag indicating whether Google Compute Engine should automatically create routes for the peering.
       &quot;advertisePeerSubnetsViaRouters&quot;: True or False, # Whether Cloud Routers in this network can automatically advertise subnets from the peer network.
diff --git a/docs/dyn/compute_alpha.regionBackendServices.html b/docs/dyn/compute_alpha.regionBackendServices.html
index 3bdc597..d37dd24 100644
--- a/docs/dyn/compute_alpha.regionBackendServices.html
+++ b/docs/dyn/compute_alpha.regionBackendServices.html
@@ -273,8 +273,8 @@
   },
   &quot;connectionTrackingPolicy&quot;: { # Connection Tracking configuration for this BackendService.
     &quot;connectionPersistenceOnUnhealthyBackends&quot;: &quot;A String&quot;, # Specifies connection persistence when backends are unhealthy. The default value is DEFAULT_FOR_PROTOCOL. If set to DEFAULT_FOR_PROTOCOL, the existing connections persist on unhealthy backends only for connection-oriented protocols (TCP and SCTP) and only if the Tracking Mode is PER_CONNECTION (default tracking mode) or the Session Affinity is configured for 5-tuple. They do not persist for UDP. If set to NEVER_PERSIST, after a backend becomes unhealthy, the existing connections on the unhealthy backend are never persisted on the unhealthy backend. They are always diverted to newly selected healthy backends (unless all backends are unhealthy). If set to ALWAYS_PERSIST, existing connections always persist on unhealthy backends regardless of protocol and session affinity. It is generally not recommended to use this mode overriding the default.
-    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity. This is only available in External TCP/UDP load balancer.
-    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For NLB the minimum(default) is 60 seconds and the maximum is 16 hours. This field will be supported only if the Connection Tracking key is less than 5-tuple.
+    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity for Network Load Balancing. This option is not available publicly.
+    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For Network Load Balancer the default is 60 seconds. This option is not available publicly. This field will be supported only if the Connection Tracking key is less than 5-tuple.
     &quot;trackingMode&quot;: &quot;A String&quot;, # Specifies the key used for connection tracking. There are two options: PER_CONNECTION: This is the default mode. The Connection Tracking is performed as per the Connection Key (default Hash Method) for the specific protocol. PER_SESSION: The Connection Tracking is performed as per the configured Session Affinity. It matches the configured Session Affinity.
   },
   &quot;consistentHash&quot;: { # This message defines settings for a consistent hash style load balancer. # Consistent Hash-based load balancing can be used to provide soft session affinity based on HTTP headers, cookies or other properties. This load balancing policy is applicable only for HTTP connections. The affinity to a particular destination host will be lost when one or more hosts are added/removed from the destination service. This field specifies parameters that control consistent hashing. This field is only applicable when localityLbPolicy is set to MAGLEV or RING_HASH. This field is applicable to either: - A regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2, and load_balancing_scheme set to INTERNAL_MANAGED. - A global backend service with the load_balancing_scheme set to INTERNAL_SELF_MANAGED. Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
@@ -830,8 +830,8 @@
   },
   &quot;connectionTrackingPolicy&quot;: { # Connection Tracking configuration for this BackendService.
     &quot;connectionPersistenceOnUnhealthyBackends&quot;: &quot;A String&quot;, # Specifies connection persistence when backends are unhealthy. The default value is DEFAULT_FOR_PROTOCOL. If set to DEFAULT_FOR_PROTOCOL, the existing connections persist on unhealthy backends only for connection-oriented protocols (TCP and SCTP) and only if the Tracking Mode is PER_CONNECTION (default tracking mode) or the Session Affinity is configured for 5-tuple. They do not persist for UDP. If set to NEVER_PERSIST, after a backend becomes unhealthy, the existing connections on the unhealthy backend are never persisted on the unhealthy backend. They are always diverted to newly selected healthy backends (unless all backends are unhealthy). If set to ALWAYS_PERSIST, existing connections always persist on unhealthy backends regardless of protocol and session affinity. It is generally not recommended to use this mode overriding the default.
-    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity. This is only available in External TCP/UDP load balancer.
-    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For NLB the minimum(default) is 60 seconds and the maximum is 16 hours. This field will be supported only if the Connection Tracking key is less than 5-tuple.
+    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity for Network Load Balancing. This option is not available publicly.
+    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For Network Load Balancer the default is 60 seconds. This option is not available publicly. This field will be supported only if the Connection Tracking key is less than 5-tuple.
     &quot;trackingMode&quot;: &quot;A String&quot;, # Specifies the key used for connection tracking. There are two options: PER_CONNECTION: This is the default mode. The Connection Tracking is performed as per the Connection Key (default Hash Method) for the specific protocol. PER_SESSION: The Connection Tracking is performed as per the configured Session Affinity. It matches the configured Session Affinity.
   },
   &quot;consistentHash&quot;: { # This message defines settings for a consistent hash style load balancer. # Consistent Hash-based load balancing can be used to provide soft session affinity based on HTTP headers, cookies or other properties. This load balancing policy is applicable only for HTTP connections. The affinity to a particular destination host will be lost when one or more hosts are added/removed from the destination service. This field specifies parameters that control consistent hashing. This field is only applicable when localityLbPolicy is set to MAGLEV or RING_HASH. This field is applicable to either: - A regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2, and load_balancing_scheme set to INTERNAL_MANAGED. - A global backend service with the load_balancing_scheme set to INTERNAL_SELF_MANAGED. Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
@@ -1305,8 +1305,8 @@
       },
       &quot;connectionTrackingPolicy&quot;: { # Connection Tracking configuration for this BackendService.
         &quot;connectionPersistenceOnUnhealthyBackends&quot;: &quot;A String&quot;, # Specifies connection persistence when backends are unhealthy. The default value is DEFAULT_FOR_PROTOCOL. If set to DEFAULT_FOR_PROTOCOL, the existing connections persist on unhealthy backends only for connection-oriented protocols (TCP and SCTP) and only if the Tracking Mode is PER_CONNECTION (default tracking mode) or the Session Affinity is configured for 5-tuple. They do not persist for UDP. If set to NEVER_PERSIST, after a backend becomes unhealthy, the existing connections on the unhealthy backend are never persisted on the unhealthy backend. They are always diverted to newly selected healthy backends (unless all backends are unhealthy). If set to ALWAYS_PERSIST, existing connections always persist on unhealthy backends regardless of protocol and session affinity. It is generally not recommended to use this mode overriding the default.
-        &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity. This is only available in External TCP/UDP load balancer.
-        &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For NLB the minimum(default) is 60 seconds and the maximum is 16 hours. This field will be supported only if the Connection Tracking key is less than 5-tuple.
+        &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity for Network Load Balancing. This option is not available publicly.
+        &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For Network Load Balancer the default is 60 seconds. This option is not available publicly. This field will be supported only if the Connection Tracking key is less than 5-tuple.
         &quot;trackingMode&quot;: &quot;A String&quot;, # Specifies the key used for connection tracking. There are two options: PER_CONNECTION: This is the default mode. The Connection Tracking is performed as per the Connection Key (default Hash Method) for the specific protocol. PER_SESSION: The Connection Tracking is performed as per the configured Session Affinity. It matches the configured Session Affinity.
       },
       &quot;consistentHash&quot;: { # This message defines settings for a consistent hash style load balancer. # Consistent Hash-based load balancing can be used to provide soft session affinity based on HTTP headers, cookies or other properties. This load balancing policy is applicable only for HTTP connections. The affinity to a particular destination host will be lost when one or more hosts are added/removed from the destination service. This field specifies parameters that control consistent hashing. This field is only applicable when localityLbPolicy is set to MAGLEV or RING_HASH. This field is applicable to either: - A regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2, and load_balancing_scheme set to INTERNAL_MANAGED. - A global backend service with the load_balancing_scheme set to INTERNAL_SELF_MANAGED. Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
@@ -1741,8 +1741,8 @@
   },
   &quot;connectionTrackingPolicy&quot;: { # Connection Tracking configuration for this BackendService.
     &quot;connectionPersistenceOnUnhealthyBackends&quot;: &quot;A String&quot;, # Specifies connection persistence when backends are unhealthy. The default value is DEFAULT_FOR_PROTOCOL. If set to DEFAULT_FOR_PROTOCOL, the existing connections persist on unhealthy backends only for connection-oriented protocols (TCP and SCTP) and only if the Tracking Mode is PER_CONNECTION (default tracking mode) or the Session Affinity is configured for 5-tuple. They do not persist for UDP. If set to NEVER_PERSIST, after a backend becomes unhealthy, the existing connections on the unhealthy backend are never persisted on the unhealthy backend. They are always diverted to newly selected healthy backends (unless all backends are unhealthy). If set to ALWAYS_PERSIST, existing connections always persist on unhealthy backends regardless of protocol and session affinity. It is generally not recommended to use this mode overriding the default.
-    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity. This is only available in External TCP/UDP load balancer.
-    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For NLB the minimum(default) is 60 seconds and the maximum is 16 hours. This field will be supported only if the Connection Tracking key is less than 5-tuple.
+    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity for Network Load Balancing. This option is not available publicly.
+    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For Network Load Balancer the default is 60 seconds. This option is not available publicly. This field will be supported only if the Connection Tracking key is less than 5-tuple.
     &quot;trackingMode&quot;: &quot;A String&quot;, # Specifies the key used for connection tracking. There are two options: PER_CONNECTION: This is the default mode. The Connection Tracking is performed as per the Connection Key (default Hash Method) for the specific protocol. PER_SESSION: The Connection Tracking is performed as per the configured Session Affinity. It matches the configured Session Affinity.
   },
   &quot;consistentHash&quot;: { # This message defines settings for a consistent hash style load balancer. # Consistent Hash-based load balancing can be used to provide soft session affinity based on HTTP headers, cookies or other properties. This load balancing policy is applicable only for HTTP connections. The affinity to a particular destination host will be lost when one or more hosts are added/removed from the destination service. This field specifies parameters that control consistent hashing. This field is only applicable when localityLbPolicy is set to MAGLEV or RING_HASH. This field is applicable to either: - A regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2, and load_balancing_scheme set to INTERNAL_MANAGED. - A global backend service with the load_balancing_scheme set to INTERNAL_SELF_MANAGED. Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
@@ -2448,8 +2448,8 @@
   },
   &quot;connectionTrackingPolicy&quot;: { # Connection Tracking configuration for this BackendService.
     &quot;connectionPersistenceOnUnhealthyBackends&quot;: &quot;A String&quot;, # Specifies connection persistence when backends are unhealthy. The default value is DEFAULT_FOR_PROTOCOL. If set to DEFAULT_FOR_PROTOCOL, the existing connections persist on unhealthy backends only for connection-oriented protocols (TCP and SCTP) and only if the Tracking Mode is PER_CONNECTION (default tracking mode) or the Session Affinity is configured for 5-tuple. They do not persist for UDP. If set to NEVER_PERSIST, after a backend becomes unhealthy, the existing connections on the unhealthy backend are never persisted on the unhealthy backend. They are always diverted to newly selected healthy backends (unless all backends are unhealthy). If set to ALWAYS_PERSIST, existing connections always persist on unhealthy backends regardless of protocol and session affinity. It is generally not recommended to use this mode overriding the default.
-    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity. This is only available in External TCP/UDP load balancer.
-    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For NLB the minimum(default) is 60 seconds and the maximum is 16 hours. This field will be supported only if the Connection Tracking key is less than 5-tuple.
+    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity for Network Load Balancing. This option is not available publicly.
+    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For Network Load Balancer the default is 60 seconds. This option is not available publicly. This field will be supported only if the Connection Tracking key is less than 5-tuple.
     &quot;trackingMode&quot;: &quot;A String&quot;, # Specifies the key used for connection tracking. There are two options: PER_CONNECTION: This is the default mode. The Connection Tracking is performed as per the Connection Key (default Hash Method) for the specific protocol. PER_SESSION: The Connection Tracking is performed as per the configured Session Affinity. It matches the configured Session Affinity.
   },
   &quot;consistentHash&quot;: { # This message defines settings for a consistent hash style load balancer. # Consistent Hash-based load balancing can be used to provide soft session affinity based on HTTP headers, cookies or other properties. This load balancing policy is applicable only for HTTP connections. The affinity to a particular destination host will be lost when one or more hosts are added/removed from the destination service. This field specifies parameters that control consistent hashing. This field is only applicable when localityLbPolicy is set to MAGLEV or RING_HASH. This field is applicable to either: - A regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2, and load_balancing_scheme set to INTERNAL_MANAGED. - A global backend service with the load_balancing_scheme set to INTERNAL_SELF_MANAGED. Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
diff --git a/docs/dyn/compute_alpha.regionDisks.html b/docs/dyn/compute_alpha.regionDisks.html
index 8761f8d..201b2fb 100644
--- a/docs/dyn/compute_alpha.regionDisks.html
+++ b/docs/dyn/compute_alpha.regionDisks.html
@@ -241,18 +241,18 @@
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource&#x27;s resource id.
   &quot;snapshotEncryptionKey&quot;: { # Encrypts the snapshot using a customer-supplied encryption key. After you encrypt a snapshot using a customer-supplied key, you must provide the same key if you use the snapshot later. For example, you must provide the encryption key when you create a disk from the encrypted snapshot in a future request. Customer-supplied encryption keys do not protect access to metadata of the snapshot. If you do not provide an encryption key when creating the snapshot, then the snapshot will be encrypted using an automatically generated key and you do not need to provide a key to use the snapshot later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDisk&quot;: &quot;A String&quot;, # The source disk used to create this snapshot.
   &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this snapshot. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given disk name.
@@ -412,10 +412,10 @@
   &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
   &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
   &quot;diskEncryptionKey&quot;: { # Encrypts the disk using a customer-supplied encryption key or a customer-managed encryption key. Encryption keys do not protect access to metadata of the disk. After you encrypt a disk with a customer-supplied key, you must provide the same key if you use the disk later. For example, to create a disk snapshot, to create a disk image, to create a machine image, or to attach the disk to a virtual machine. After you encrypt a disk with a customer-managed key, the diskEncryptionKey.kmsKeyName is set to a key *version* name once the disk is created. The disk is encrypted with this version of the key. In the response, diskEncryptionKey.kmsKeyName appears in the following format: &quot;diskEncryptionKey.kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key /cryptoKeysVersions/version If you do not provide an encryption key when creating the disk, then the disk is encrypted using an automatically generated key and you don&#x27;t need to provide a key to use the disk later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;eraseWindowsVssSignature&quot;: True or False, # Specifies whether the disk restored from a source snapshot should erase Windows specific VSS signature.
@@ -461,23 +461,21 @@
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the disk used to create this disk. This value identifies the exact disk that was used to create this persistent disk. For example, if you created the persistent disk from a disk that was later deleted and recreated under the same name, the source disk ID would identify the exact version of the disk that was used.
   &quot;sourceImage&quot;: &quot;A String&quot;, # The source image used to create this disk. If the source image is deleted, this field will not be set. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family
   &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
-  &quot;sourceInPlaceSnapshot&quot;: &quot;A String&quot;, # [Deprecated] The source in-place snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/inPlaceSnapshots/inPlaceSnapshots - projects/project/global/inPlaceSnapshots/inPlaceSnapshots - global/inPlaceSnapshots/inPlaceSnapshots
-  &quot;sourceInPlaceSnapshotId&quot;: &quot;A String&quot;, # Deprecated The unique ID of the in-place snapshot used to create this disk. This value identifies the exact in-place snapshot that was used to create this persistent disk. For example, if you created the persistent disk from an in-place snapshot that was later deleted and recreated under the same name, the source in-place snapshot ID would identify the exact version of the in-place snapshot that was used.
   &quot;sourceInstantSnapshot&quot;: &quot;A String&quot;, # The source instant snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /instantSnapshots/instantSnapshot - projects/project/zones/zone/instantSnapshots/instantSnapshot - zones/zone/instantSnapshots/instantSnapshot
   &quot;sourceInstantSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the instant snapshot used to create this disk. This value identifies the exact instant snapshot that was used to create this persistent disk. For example, if you created the persistent disk from an instant snapshot that was later deleted and recreated under the same name, the source instant snapshot ID would identify the exact version of the instant snapshot that was used.
   &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/snapshots/snapshot - projects/project/global/snapshots/snapshot - global/snapshots/snapshot
   &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.
@@ -614,10 +612,10 @@
   &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
   &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
   &quot;diskEncryptionKey&quot;: { # Encrypts the disk using a customer-supplied encryption key or a customer-managed encryption key. Encryption keys do not protect access to metadata of the disk. After you encrypt a disk with a customer-supplied key, you must provide the same key if you use the disk later. For example, to create a disk snapshot, to create a disk image, to create a machine image, or to attach the disk to a virtual machine. After you encrypt a disk with a customer-managed key, the diskEncryptionKey.kmsKeyName is set to a key *version* name once the disk is created. The disk is encrypted with this version of the key. In the response, diskEncryptionKey.kmsKeyName appears in the following format: &quot;diskEncryptionKey.kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key /cryptoKeysVersions/version If you do not provide an encryption key when creating the disk, then the disk is encrypted using an automatically generated key and you don&#x27;t need to provide a key to use the disk later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;eraseWindowsVssSignature&quot;: True or False, # Specifies whether the disk restored from a source snapshot should erase Windows specific VSS signature.
@@ -663,23 +661,21 @@
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the disk used to create this disk. This value identifies the exact disk that was used to create this persistent disk. For example, if you created the persistent disk from a disk that was later deleted and recreated under the same name, the source disk ID would identify the exact version of the disk that was used.
   &quot;sourceImage&quot;: &quot;A String&quot;, # The source image used to create this disk. If the source image is deleted, this field will not be set. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family
   &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
-  &quot;sourceInPlaceSnapshot&quot;: &quot;A String&quot;, # [Deprecated] The source in-place snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/inPlaceSnapshots/inPlaceSnapshots - projects/project/global/inPlaceSnapshots/inPlaceSnapshots - global/inPlaceSnapshots/inPlaceSnapshots
-  &quot;sourceInPlaceSnapshotId&quot;: &quot;A String&quot;, # Deprecated The unique ID of the in-place snapshot used to create this disk. This value identifies the exact in-place snapshot that was used to create this persistent disk. For example, if you created the persistent disk from an in-place snapshot that was later deleted and recreated under the same name, the source in-place snapshot ID would identify the exact version of the in-place snapshot that was used.
   &quot;sourceInstantSnapshot&quot;: &quot;A String&quot;, # The source instant snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /instantSnapshots/instantSnapshot - projects/project/zones/zone/instantSnapshots/instantSnapshot - zones/zone/instantSnapshots/instantSnapshot
   &quot;sourceInstantSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the instant snapshot used to create this disk. This value identifies the exact instant snapshot that was used to create this persistent disk. For example, if you created the persistent disk from an instant snapshot that was later deleted and recreated under the same name, the source instant snapshot ID would identify the exact version of the instant snapshot that was used.
   &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/snapshots/snapshot - projects/project/global/snapshots/snapshot - global/snapshots/snapshot
   &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.
@@ -781,10 +777,10 @@
       &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
       &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
       &quot;diskEncryptionKey&quot;: { # Encrypts the disk using a customer-supplied encryption key or a customer-managed encryption key. Encryption keys do not protect access to metadata of the disk. After you encrypt a disk with a customer-supplied key, you must provide the same key if you use the disk later. For example, to create a disk snapshot, to create a disk image, to create a machine image, or to attach the disk to a virtual machine. After you encrypt a disk with a customer-managed key, the diskEncryptionKey.kmsKeyName is set to a key *version* name once the disk is created. The disk is encrypted with this version of the key. In the response, diskEncryptionKey.kmsKeyName appears in the following format: &quot;diskEncryptionKey.kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key /cryptoKeysVersions/version If you do not provide an encryption key when creating the disk, then the disk is encrypted using an automatically generated key and you don&#x27;t need to provide a key to use the disk later.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;eraseWindowsVssSignature&quot;: True or False, # Specifies whether the disk restored from a source snapshot should erase Windows specific VSS signature.
@@ -830,23 +826,21 @@
       &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the disk used to create this disk. This value identifies the exact disk that was used to create this persistent disk. For example, if you created the persistent disk from a disk that was later deleted and recreated under the same name, the source disk ID would identify the exact version of the disk that was used.
       &quot;sourceImage&quot;: &quot;A String&quot;, # The source image used to create this disk. If the source image is deleted, this field will not be set. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family
       &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
-      &quot;sourceInPlaceSnapshot&quot;: &quot;A String&quot;, # [Deprecated] The source in-place snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/inPlaceSnapshots/inPlaceSnapshots - projects/project/global/inPlaceSnapshots/inPlaceSnapshots - global/inPlaceSnapshots/inPlaceSnapshots
-      &quot;sourceInPlaceSnapshotId&quot;: &quot;A String&quot;, # Deprecated The unique ID of the in-place snapshot used to create this disk. This value identifies the exact in-place snapshot that was used to create this persistent disk. For example, if you created the persistent disk from an in-place snapshot that was later deleted and recreated under the same name, the source in-place snapshot ID would identify the exact version of the in-place snapshot that was used.
       &quot;sourceInstantSnapshot&quot;: &quot;A String&quot;, # The source instant snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /instantSnapshots/instantSnapshot - projects/project/zones/zone/instantSnapshots/instantSnapshot - zones/zone/instantSnapshots/instantSnapshot
       &quot;sourceInstantSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the instant snapshot used to create this disk. This value identifies the exact instant snapshot that was used to create this persistent disk. For example, if you created the persistent disk from an instant snapshot that was later deleted and recreated under the same name, the source instant snapshot ID would identify the exact version of the instant snapshot that was used.
       &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/snapshots/snapshot - projects/project/global/snapshots/snapshot - global/snapshots/snapshot
       &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.
@@ -1373,10 +1367,10 @@
   &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
   &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
   &quot;diskEncryptionKey&quot;: { # Encrypts the disk using a customer-supplied encryption key or a customer-managed encryption key. Encryption keys do not protect access to metadata of the disk. After you encrypt a disk with a customer-supplied key, you must provide the same key if you use the disk later. For example, to create a disk snapshot, to create a disk image, to create a machine image, or to attach the disk to a virtual machine. After you encrypt a disk with a customer-managed key, the diskEncryptionKey.kmsKeyName is set to a key *version* name once the disk is created. The disk is encrypted with this version of the key. In the response, diskEncryptionKey.kmsKeyName appears in the following format: &quot;diskEncryptionKey.kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key /cryptoKeysVersions/version If you do not provide an encryption key when creating the disk, then the disk is encrypted using an automatically generated key and you don&#x27;t need to provide a key to use the disk later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;eraseWindowsVssSignature&quot;: True or False, # Specifies whether the disk restored from a source snapshot should erase Windows specific VSS signature.
@@ -1422,23 +1416,21 @@
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the disk used to create this disk. This value identifies the exact disk that was used to create this persistent disk. For example, if you created the persistent disk from a disk that was later deleted and recreated under the same name, the source disk ID would identify the exact version of the disk that was used.
   &quot;sourceImage&quot;: &quot;A String&quot;, # The source image used to create this disk. If the source image is deleted, this field will not be set. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family
   &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
-  &quot;sourceInPlaceSnapshot&quot;: &quot;A String&quot;, # [Deprecated] The source in-place snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/inPlaceSnapshots/inPlaceSnapshots - projects/project/global/inPlaceSnapshots/inPlaceSnapshots - global/inPlaceSnapshots/inPlaceSnapshots
-  &quot;sourceInPlaceSnapshotId&quot;: &quot;A String&quot;, # Deprecated The unique ID of the in-place snapshot used to create this disk. This value identifies the exact in-place snapshot that was used to create this persistent disk. For example, if you created the persistent disk from an in-place snapshot that was later deleted and recreated under the same name, the source in-place snapshot ID would identify the exact version of the in-place snapshot that was used.
   &quot;sourceInstantSnapshot&quot;: &quot;A String&quot;, # The source instant snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /instantSnapshots/instantSnapshot - projects/project/zones/zone/instantSnapshots/instantSnapshot - zones/zone/instantSnapshots/instantSnapshot
   &quot;sourceInstantSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the instant snapshot used to create this disk. This value identifies the exact instant snapshot that was used to create this persistent disk. For example, if you created the persistent disk from an instant snapshot that was later deleted and recreated under the same name, the source instant snapshot ID would identify the exact version of the instant snapshot that was used.
   &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/snapshots/snapshot - projects/project/global/snapshots/snapshot - global/snapshots/snapshot
   &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.
diff --git a/docs/dyn/compute_alpha.regionInstanceGroupManagers.html b/docs/dyn/compute_alpha.regionInstanceGroupManagers.html
index 1f6eed1..c2e5299 100644
--- a/docs/dyn/compute_alpha.regionInstanceGroupManagers.html
+++ b/docs/dyn/compute_alpha.regionInstanceGroupManagers.html
@@ -127,7 +127,7 @@
 <p class="firstline">Retrieves the next page of results.</p>
 <p class="toc_element">
   <code><a href="#patch">patch(project, region, instanceGroupManager, body=None, requestId=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is patched even if the instances in the group are still in the process of being patched. You must separately verify the status of the individual instances with the listmanagedinstances method. This method supports PATCH semantics and uses the JSON merge patch format and processing rules.</p>
+<p class="firstline">Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is patched even if the instances in the group are still in the process of being patched. You must separately verify the status of the individual instances with the listmanagedinstances method. This method supports PATCH semantics and uses the JSON merge patch format and processing rules. If you update your group to specify a new template or instance configuration, it's possible that your intended specification for each VM in the group is different from the current state of that VM. To learn how to apply an updated configuration to the VMs in a MIG, see Updating instances in a MIG.</p>
 <p class="toc_element">
   <code><a href="#patchPerInstanceConfigs">patchPerInstanceConfigs(project, region, instanceGroupManager, body=None, requestId=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Inserts or patches per-instance configs for the managed instance group. perInstanceConfig.name serves as a key used to distinguish whether to perform insert or patch.</p>
@@ -166,7 +166,7 @@
 <p class="firstline">Returns permissions that a caller has on the specified resource.</p>
 <p class="toc_element">
   <code><a href="#update">update(project, region, instanceGroupManager, body=None, requestId=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is updated even if the instances in the group have not yet been updated. You must separately verify the status of the individual instances with the listmanagedinstances method.</p>
+<p class="firstline">Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is updated even if the instances in the group have not yet been updated. You must separately verify the status of the individual instances with the listmanagedinstances method. If you update your group to specify a new template or instance configuration, it's possible that your intended specification for each VM in the group is different from the current state of that VM. To learn how to apply an updated configuration to the VMs in a MIG, see Updating instances in a MIG.</p>
 <p class="toc_element">
   <code><a href="#updatePerInstanceConfigs">updatePerInstanceConfigs(project, region, instanceGroupManager, body=None, requestId=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Inserts or updates per-instance configs for the managed instance group. perInstanceConfig.name serves as a key used to distinguish whether to perform insert or patch.</p>
@@ -666,6 +666,16 @@
   An object of the form:
 
     { # Represents a Managed Instance Group resource. An instance group is a collection of VM instances that you can manage as a single entity. For more information, read Instance groups. For zonal Managed Instance Group, use the instanceGroupManagers resource. For regional Managed Instance Group, use the regionInstanceGroupManagers resource.
+  &quot;allInstancesConfig&quot;: { # Specifies the instances configs overrides that should be applied for all instances in the MIG.
+    &quot;properties&quot;: { # Represents the change that you want to make to the instance properties. # Properties for instances that are created using this instances config. You can add or modify properties using the instanceGroupManagers.patch or regionInstanceGroupManagers.patch. After setting instances_config, you must update your instances to use it; for example, you can use the applyUpdatesToInstances method.
+      &quot;labels&quot;: { # The label key-value pairs that you want to patch onto the instance.
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+      &quot;metadata&quot;: { # The metadata key-value pairs that you want to patch onto the instance. For more information, see Project and instance metadata.
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+    },
+  },
   &quot;autoHealingPolicies&quot;: [ # The autohealing policy for this managed instance group. You can specify only one value.
     {
       &quot;healthCheck&quot;: &quot;A String&quot;, # The URL for the health check that signals autohealing.
@@ -675,6 +685,7 @@
         &quot;fixed&quot;: 42, # Specifies a fixed number of VM instances. This must be a positive integer.
         &quot;percent&quot;: 42, # Specifies a percentage of instances between 0 to 100%, inclusive. For example, specify 80 for 80%.
       },
+      &quot;updateInstances&quot;: &quot;A String&quot;,
     },
   ],
   &quot;baseInstanceName&quot;: &quot;A String&quot;, # The base instance name to use for instances in this group. The value must be 1-58 characters long. Instances are named by appending a hyphen and a random four-character string to the base instance name. The base instance name must comply with RFC1035.
@@ -748,6 +759,10 @@
     },
   },
   &quot;status&quot;: { # [Output Only] The status of this managed instance group.
+    &quot;allInstancesConfig&quot;: { # [Output Only] A status of consistency of Instances&#x27; config applied to instances with Instances&#x27; config defined in managed instance group.
+      &quot;currentRevision&quot;: &quot;A String&quot;, # [Output Only] Current instances&#x27; config revision. This value is in RFC3339 text format.
+      &quot;effective&quot;: True or False, # [Output Only] A bit indicating whether instances&#x27; config has been applied to all managed instances in managed instance group.
+    },
     &quot;autoscaler&quot;: &quot;A String&quot;, # [Output Only] The URL of the Autoscaler that targets this instance group manager.
     &quot;isStable&quot;: True or False, # [Output Only] A bit indicating whether the managed instance group is in a stable state. A stable state means that: none of the instances in the managed instance group is currently undergoing any type of change (for example, creation, restart, or deletion); no future changes are scheduled for instances in the managed instance group; and the managed instance group itself is not being modified.
     &quot;stateful&quot;: { # [Output Only] Stateful status of the given Instance Group Manager.
@@ -812,6 +827,16 @@
     The object takes the form of:
 
 { # Represents a Managed Instance Group resource. An instance group is a collection of VM instances that you can manage as a single entity. For more information, read Instance groups. For zonal Managed Instance Group, use the instanceGroupManagers resource. For regional Managed Instance Group, use the regionInstanceGroupManagers resource.
+  &quot;allInstancesConfig&quot;: { # Specifies the instances configs overrides that should be applied for all instances in the MIG.
+    &quot;properties&quot;: { # Represents the change that you want to make to the instance properties. # Properties for instances that are created using this instances config. You can add or modify properties using the instanceGroupManagers.patch or regionInstanceGroupManagers.patch. After setting instances_config, you must update your instances to use it; for example, you can use the applyUpdatesToInstances method.
+      &quot;labels&quot;: { # The label key-value pairs that you want to patch onto the instance.
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+      &quot;metadata&quot;: { # The metadata key-value pairs that you want to patch onto the instance. For more information, see Project and instance metadata.
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+    },
+  },
   &quot;autoHealingPolicies&quot;: [ # The autohealing policy for this managed instance group. You can specify only one value.
     {
       &quot;healthCheck&quot;: &quot;A String&quot;, # The URL for the health check that signals autohealing.
@@ -821,6 +846,7 @@
         &quot;fixed&quot;: 42, # Specifies a fixed number of VM instances. This must be a positive integer.
         &quot;percent&quot;: 42, # Specifies a percentage of instances between 0 to 100%, inclusive. For example, specify 80 for 80%.
       },
+      &quot;updateInstances&quot;: &quot;A String&quot;,
     },
   ],
   &quot;baseInstanceName&quot;: &quot;A String&quot;, # The base instance name to use for instances in this group. The value must be 1-58 characters long. Instances are named by appending a hyphen and a random four-character string to the base instance name. The base instance name must comply with RFC1035.
@@ -894,6 +920,10 @@
     },
   },
   &quot;status&quot;: { # [Output Only] The status of this managed instance group.
+    &quot;allInstancesConfig&quot;: { # [Output Only] A status of consistency of Instances&#x27; config applied to instances with Instances&#x27; config defined in managed instance group.
+      &quot;currentRevision&quot;: &quot;A String&quot;, # [Output Only] Current instances&#x27; config revision. This value is in RFC3339 text format.
+      &quot;effective&quot;: True or False, # [Output Only] A bit indicating whether instances&#x27; config has been applied to all managed instances in managed instance group.
+    },
     &quot;autoscaler&quot;: &quot;A String&quot;, # [Output Only] The URL of the Autoscaler that targets this instance group manager.
     &quot;isStable&quot;: True or False, # [Output Only] A bit indicating whether the managed instance group is in a stable state. A stable state means that: none of the instances in the managed instance group is currently undergoing any type of change (for example, creation, restart, or deletion); no future changes are scheduled for instances in the managed instance group; and the managed instance group itself is not being modified.
     &quot;stateful&quot;: { # [Output Only] Stateful status of the given Instance Group Manager.
@@ -1027,6 +1057,16 @@
   &quot;id&quot;: &quot;A String&quot;, # [Output Only] Unique identifier for the resource; defined by the server.
   &quot;items&quot;: [ # A list of InstanceGroupManager resources.
     { # Represents a Managed Instance Group resource. An instance group is a collection of VM instances that you can manage as a single entity. For more information, read Instance groups. For zonal Managed Instance Group, use the instanceGroupManagers resource. For regional Managed Instance Group, use the regionInstanceGroupManagers resource.
+      &quot;allInstancesConfig&quot;: { # Specifies the instances configs overrides that should be applied for all instances in the MIG.
+        &quot;properties&quot;: { # Represents the change that you want to make to the instance properties. # Properties for instances that are created using this instances config. You can add or modify properties using the instanceGroupManagers.patch or regionInstanceGroupManagers.patch. After setting instances_config, you must update your instances to use it; for example, you can use the applyUpdatesToInstances method.
+          &quot;labels&quot;: { # The label key-value pairs that you want to patch onto the instance.
+            &quot;a_key&quot;: &quot;A String&quot;,
+          },
+          &quot;metadata&quot;: { # The metadata key-value pairs that you want to patch onto the instance. For more information, see Project and instance metadata.
+            &quot;a_key&quot;: &quot;A String&quot;,
+          },
+        },
+      },
       &quot;autoHealingPolicies&quot;: [ # The autohealing policy for this managed instance group. You can specify only one value.
         {
           &quot;healthCheck&quot;: &quot;A String&quot;, # The URL for the health check that signals autohealing.
@@ -1036,6 +1076,7 @@
             &quot;fixed&quot;: 42, # Specifies a fixed number of VM instances. This must be a positive integer.
             &quot;percent&quot;: 42, # Specifies a percentage of instances between 0 to 100%, inclusive. For example, specify 80 for 80%.
           },
+          &quot;updateInstances&quot;: &quot;A String&quot;,
         },
       ],
       &quot;baseInstanceName&quot;: &quot;A String&quot;, # The base instance name to use for instances in this group. The value must be 1-58 characters long. Instances are named by appending a hyphen and a random four-character string to the base instance name. The base instance name must comply with RFC1035.
@@ -1109,6 +1150,10 @@
         },
       },
       &quot;status&quot;: { # [Output Only] The status of this managed instance group.
+        &quot;allInstancesConfig&quot;: { # [Output Only] A status of consistency of Instances&#x27; config applied to instances with Instances&#x27; config defined in managed instance group.
+          &quot;currentRevision&quot;: &quot;A String&quot;, # [Output Only] Current instances&#x27; config revision. This value is in RFC3339 text format.
+          &quot;effective&quot;: True or False, # [Output Only] A bit indicating whether instances&#x27; config has been applied to all managed instances in managed instance group.
+        },
         &quot;autoscaler&quot;: &quot;A String&quot;, # [Output Only] The URL of the Autoscaler that targets this instance group manager.
         &quot;isStable&quot;: True or False, # [Output Only] A bit indicating whether the managed instance group is in a stable state. A stable state means that: none of the instances in the managed instance group is currently undergoing any type of change (for example, creation, restart, or deletion); no future changes are scheduled for instances in the managed instance group; and the managed instance group itself is not being modified.
         &quot;stateful&quot;: { # [Output Only] Stateful status of the given Instance Group Manager.
@@ -1258,6 +1303,9 @@
     {
   &quot;managedInstances&quot;: [ # A list of managed instances.
     { # A Managed Instance resource.
+      &quot;allInstancesConfig&quot;: { # [Output Only] Instances config revision applied to this instance.
+        &quot;revision&quot;: &quot;A String&quot;, # [Output Only] Instances config revision. This value is in RFC3339 text format.
+      },
       &quot;currentAction&quot;: &quot;A String&quot;, # [Output Only] The current action that the managed instance group has scheduled for the instance. Possible values: - NONE The instance is running, and the managed instance group does not have any scheduled actions for this instance. - CREATING The managed instance group is creating this instance. If the group fails to create this instance, it will try again until it is successful. - CREATING_WITHOUT_RETRIES The managed instance group is attempting to create this instance only once. If the group fails to create this instance, it does not try again and the group&#x27;s targetSize value is decreased instead. - RECREATING The managed instance group is recreating this instance. - DELETING The managed instance group is permanently deleting this instance. - ABANDONING The managed instance group is abandoning this instance. The instance will be removed from the instance group and from any target pools that are associated with this group. - RESTARTING The managed instance group is restarting the instance. - REFRESHING The managed instance group is applying configuration changes to the instance without stopping it. For example, the group can update the target pool list for an instance without stopping that instance. - VERIFYING The managed instance group has created the instance and it is in the process of being verified.
       &quot;id&quot;: &quot;A String&quot;, # [Output only] The unique identifier for this resource. This field is empty when instance does not exist.
       &quot;instance&quot;: &quot;A String&quot;, # [Output Only] The URL of the instance. The URL can exist even if the instance has not yet been created.
@@ -1470,7 +1518,7 @@
 
 <div class="method">
     <code class="details" id="patch">patch(project, region, instanceGroupManager, body=None, requestId=None, x__xgafv=None)</code>
-  <pre>Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is patched even if the instances in the group are still in the process of being patched. You must separately verify the status of the individual instances with the listmanagedinstances method. This method supports PATCH semantics and uses the JSON merge patch format and processing rules.
+  <pre>Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is patched even if the instances in the group are still in the process of being patched. You must separately verify the status of the individual instances with the listmanagedinstances method. This method supports PATCH semantics and uses the JSON merge patch format and processing rules. If you update your group to specify a new template or instance configuration, it&#x27;s possible that your intended specification for each VM in the group is different from the current state of that VM. To learn how to apply an updated configuration to the VMs in a MIG, see Updating instances in a MIG.
 
 Args:
   project: string, Project ID for this request. (required)
@@ -1480,6 +1528,16 @@
     The object takes the form of:
 
 { # Represents a Managed Instance Group resource. An instance group is a collection of VM instances that you can manage as a single entity. For more information, read Instance groups. For zonal Managed Instance Group, use the instanceGroupManagers resource. For regional Managed Instance Group, use the regionInstanceGroupManagers resource.
+  &quot;allInstancesConfig&quot;: { # Specifies the instances configs overrides that should be applied for all instances in the MIG.
+    &quot;properties&quot;: { # Represents the change that you want to make to the instance properties. # Properties for instances that are created using this instances config. You can add or modify properties using the instanceGroupManagers.patch or regionInstanceGroupManagers.patch. After setting instances_config, you must update your instances to use it; for example, you can use the applyUpdatesToInstances method.
+      &quot;labels&quot;: { # The label key-value pairs that you want to patch onto the instance.
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+      &quot;metadata&quot;: { # The metadata key-value pairs that you want to patch onto the instance. For more information, see Project and instance metadata.
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+    },
+  },
   &quot;autoHealingPolicies&quot;: [ # The autohealing policy for this managed instance group. You can specify only one value.
     {
       &quot;healthCheck&quot;: &quot;A String&quot;, # The URL for the health check that signals autohealing.
@@ -1489,6 +1547,7 @@
         &quot;fixed&quot;: 42, # Specifies a fixed number of VM instances. This must be a positive integer.
         &quot;percent&quot;: 42, # Specifies a percentage of instances between 0 to 100%, inclusive. For example, specify 80 for 80%.
       },
+      &quot;updateInstances&quot;: &quot;A String&quot;,
     },
   ],
   &quot;baseInstanceName&quot;: &quot;A String&quot;, # The base instance name to use for instances in this group. The value must be 1-58 characters long. Instances are named by appending a hyphen and a random four-character string to the base instance name. The base instance name must comply with RFC1035.
@@ -1562,6 +1621,10 @@
     },
   },
   &quot;status&quot;: { # [Output Only] The status of this managed instance group.
+    &quot;allInstancesConfig&quot;: { # [Output Only] A status of consistency of Instances&#x27; config applied to instances with Instances&#x27; config defined in managed instance group.
+      &quot;currentRevision&quot;: &quot;A String&quot;, # [Output Only] Current instances&#x27; config revision. This value is in RFC3339 text format.
+      &quot;effective&quot;: True or False, # [Output Only] A bit indicating whether instances&#x27; config has been applied to all managed instances in managed instance group.
+    },
     &quot;autoscaler&quot;: &quot;A String&quot;, # [Output Only] The URL of the Autoscaler that targets this instance group manager.
     &quot;isStable&quot;: True or False, # [Output Only] A bit indicating whether the managed instance group is in a stable state. A stable state means that: none of the instances in the managed instance group is currently undergoing any type of change (for example, creation, restart, or deletion); no future changes are scheduled for instances in the managed instance group; and the managed instance group itself is not being modified.
     &quot;stateful&quot;: { # [Output Only] Stateful status of the given Instance Group Manager.
@@ -2087,6 +2150,7 @@
         &quot;fixed&quot;: 42, # Specifies a fixed number of VM instances. This must be a positive integer.
         &quot;percent&quot;: 42, # Specifies a percentage of instances between 0 to 100%, inclusive. For example, specify 80 for 80%.
       },
+      &quot;updateInstances&quot;: &quot;A String&quot;,
     },
   ],
 }
@@ -2553,7 +2617,7 @@
 
 <div class="method">
     <code class="details" id="update">update(project, region, instanceGroupManager, body=None, requestId=None, x__xgafv=None)</code>
-  <pre>Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is updated even if the instances in the group have not yet been updated. You must separately verify the status of the individual instances with the listmanagedinstances method.
+  <pre>Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is updated even if the instances in the group have not yet been updated. You must separately verify the status of the individual instances with the listmanagedinstances method. If you update your group to specify a new template or instance configuration, it&#x27;s possible that your intended specification for each VM in the group is different from the current state of that VM. To learn how to apply an updated configuration to the VMs in a MIG, see Updating instances in a MIG.
 
 Args:
   project: string, Project ID for this request. (required)
@@ -2563,6 +2627,16 @@
     The object takes the form of:
 
 { # Represents a Managed Instance Group resource. An instance group is a collection of VM instances that you can manage as a single entity. For more information, read Instance groups. For zonal Managed Instance Group, use the instanceGroupManagers resource. For regional Managed Instance Group, use the regionInstanceGroupManagers resource.
+  &quot;allInstancesConfig&quot;: { # Specifies the instances configs overrides that should be applied for all instances in the MIG.
+    &quot;properties&quot;: { # Represents the change that you want to make to the instance properties. # Properties for instances that are created using this instances config. You can add or modify properties using the instanceGroupManagers.patch or regionInstanceGroupManagers.patch. After setting instances_config, you must update your instances to use it; for example, you can use the applyUpdatesToInstances method.
+      &quot;labels&quot;: { # The label key-value pairs that you want to patch onto the instance.
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+      &quot;metadata&quot;: { # The metadata key-value pairs that you want to patch onto the instance. For more information, see Project and instance metadata.
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+    },
+  },
   &quot;autoHealingPolicies&quot;: [ # The autohealing policy for this managed instance group. You can specify only one value.
     {
       &quot;healthCheck&quot;: &quot;A String&quot;, # The URL for the health check that signals autohealing.
@@ -2572,6 +2646,7 @@
         &quot;fixed&quot;: 42, # Specifies a fixed number of VM instances. This must be a positive integer.
         &quot;percent&quot;: 42, # Specifies a percentage of instances between 0 to 100%, inclusive. For example, specify 80 for 80%.
       },
+      &quot;updateInstances&quot;: &quot;A String&quot;,
     },
   ],
   &quot;baseInstanceName&quot;: &quot;A String&quot;, # The base instance name to use for instances in this group. The value must be 1-58 characters long. Instances are named by appending a hyphen and a random four-character string to the base instance name. The base instance name must comply with RFC1035.
@@ -2645,6 +2720,10 @@
     },
   },
   &quot;status&quot;: { # [Output Only] The status of this managed instance group.
+    &quot;allInstancesConfig&quot;: { # [Output Only] A status of consistency of Instances&#x27; config applied to instances with Instances&#x27; config defined in managed instance group.
+      &quot;currentRevision&quot;: &quot;A String&quot;, # [Output Only] Current instances&#x27; config revision. This value is in RFC3339 text format.
+      &quot;effective&quot;: True or False, # [Output Only] A bit indicating whether instances&#x27; config has been applied to all managed instances in managed instance group.
+    },
     &quot;autoscaler&quot;: &quot;A String&quot;, # [Output Only] The URL of the Autoscaler that targets this instance group manager.
     &quot;isStable&quot;: True or False, # [Output Only] A bit indicating whether the managed instance group is in a stable state. A stable state means that: none of the instances in the managed instance group is currently undergoing any type of change (for example, creation, restart, or deletion); no future changes are scheduled for instances in the managed instance group; and the managed instance group itself is not being modified.
     &quot;stateful&quot;: { # [Output Only] Stateful status of the given Instance Group Manager.
diff --git a/docs/dyn/compute_alpha.regionInstances.html b/docs/dyn/compute_alpha.regionInstances.html
index 0359307..69ce2c3 100644
--- a/docs/dyn/compute_alpha.regionInstances.html
+++ b/docs/dyn/compute_alpha.regionInstances.html
@@ -96,6 +96,7 @@
   &quot;instance&quot;: { # Represents an Instance resource. An instance is a virtual machine that is hosted on Google Cloud Platform. For more information, read Virtual Machine Instances. # DEPRECATED: Please use instance_properties instead.
     &quot;advancedMachineFeatures&quot;: { # Specifies options for controlling advanced machine features. Options that would traditionally be configured in a BIOS belong here. Features that require operating system support may have corresponding entries in the GuestOsFeatures of an Image (e.g., whether or not the OS in the Image supports nested virtualization being enabled or disabled). # Controls for advanced machine-related behavior features.
       &quot;enableNestedVirtualization&quot;: True or False, # Whether to enable nested virtualization or not (default is false).
+      &quot;enableUefiNetworking&quot;: True or False, # Whether to enable UEFI networking for instance creation.
       &quot;numaNodeCount&quot;: 42, # The number of vNUMA nodes.
       &quot;threadsPerCore&quot;: 42, # The number of threads per physical core. To disable simultaneous multithreading (SMT) set this to 1. If unset, the maximum number of threads supported per core by the underlying processor is assumed.
       &quot;visibleCoreCount&quot;: 42, # The number of physical cores to expose to an instance. Multiply by the number of threads per core to compute the total number of virtual CPUs to expose to the instance. If unset, the number of cores is inferred from the instance&#x27;s nominal CPU count and the underlying platform&#x27;s SMT width.
@@ -114,10 +115,10 @@
         &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
         &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
         &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -159,18 +160,18 @@
           ],
           &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
           &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
           &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
         },
@@ -227,10 +228,10 @@
     &quot;hostname&quot;: &quot;A String&quot;, # Specifies the hostname of the instance. The specified hostname must be RFC1035 compliant. If hostname is not specified, the default hostname is [INSTANCE_NAME].c.[PROJECT_ID].internal when using the global DNS, and [INSTANCE_NAME].[ZONE].c.[PROJECT_ID].internal when using zonal DNS.
     &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
     &quot;instanceEncryptionKey&quot;: { # Encrypts or decrypts data for an instance with a customer-supplied encryption key. If you are creating a new instance, this field encrypts the local SSD and in-memory contents of the instance using a key that you provide. If you are restarting an instance protected with a customer-supplied encryption key, you must provide the correct key in order to successfully restart the instance. If you do not provide an encryption key when creating the instance, then the local SSD and in-memory contents will be encrypted using an automatically generated key and you do not need to provide a key to start the instance later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt local SSDs and in-memory content in a managed instance group.
-      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
       &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
     },
     &quot;kind&quot;: &quot;compute#instance&quot;, # [Output Only] Type of the resource. Always compute#instance for instances.
@@ -396,10 +397,10 @@
     },
     &quot;sourceMachineImage&quot;: &quot;A String&quot;, # Source machine image
     &quot;sourceMachineImageEncryptionKey&quot;: { # Source machine image encryption key when creating an instance from a machine image.
-      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
       &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
     },
     &quot;startRestricted&quot;: True or False, # [Output Only] Whether a VM has been restricted for start because Compute Engine has detected suspicious activity.
@@ -411,7 +412,7 @@
         &quot;A String&quot;,
       ],
     },
-    &quot;upcomingMaintenance&quot;: { # Upcoming Maintenance notification information. # [Output Only] Specifies upcoming maintenance for the instance.
+    &quot;upcomingMaintenance&quot;: { # Upcoming Maintenance notification information. TODO(b/196881882) Deprecate this proto once it&#x27;s fully migrated to be under proto ResourceStatus.UpcomingMaintenance. # [Output Only] Specifies upcoming maintenance for the instance.
       &quot;date&quot;: &quot;A String&quot;, # [Output Only] The date when the maintenance will take place. This value is in RFC3339 text format. DEPRECATED: Use start_time_window instead.
       &quot;startTimeWindow&quot;: { # Represents a window of time using two timestamps: `earliest` and `latest`. This timestamp values are in RFC3339 text format. # [Output Only] The start time window of the maintenance disruption.
         &quot;earliest&quot;: &quot;A String&quot;,
@@ -425,6 +426,7 @@
   &quot;instanceProperties&quot;: { # The instance properties defining the VM instances to be created. Required if sourceInstanceTemplate is not provided.
     &quot;advancedMachineFeatures&quot;: { # Specifies options for controlling advanced machine features. Options that would traditionally be configured in a BIOS belong here. Features that require operating system support may have corresponding entries in the GuestOsFeatures of an Image (e.g., whether or not the OS in the Image supports nested virtualization being enabled or disabled). # Controls for advanced machine-related behavior features.
       &quot;enableNestedVirtualization&quot;: True or False, # Whether to enable nested virtualization or not (default is false).
+      &quot;enableUefiNetworking&quot;: True or False, # Whether to enable UEFI networking for instance creation.
       &quot;numaNodeCount&quot;: 42, # The number of vNUMA nodes.
       &quot;threadsPerCore&quot;: 42, # The number of threads per physical core. To disable simultaneous multithreading (SMT) set this to 1. If unset, the maximum number of threads supported per core by the underlying processor is assumed.
       &quot;visibleCoreCount&quot;: 42, # The number of physical cores to expose to an instance. Multiply by the number of threads per core to compute the total number of virtual CPUs to expose to the instance. If unset, the number of cores is inferred from the instance&#x27;s nominal CPU count and the underlying platform&#x27;s SMT width.
@@ -440,10 +442,10 @@
         &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
         &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
         &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -485,18 +487,18 @@
           ],
           &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
           &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
           &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
         },
@@ -627,7 +629,7 @@
       &quot;externalIpEgressBandwidthTier&quot;: &quot;A String&quot;,
       &quot;totalEgressBandwidthTier&quot;: &quot;A String&quot;,
     },
-    &quot;postKeyRevocationActionType&quot;: &quot;A String&quot;, # PostKeyRevocationActionType of the instance.
+    &quot;postKeyRevocationActionType&quot;: &quot;A String&quot;, # PostKeyRevocationActionType of the instance.(will be deprecated soon)
     &quot;privateIpv6GoogleAccess&quot;: &quot;A String&quot;, # The private IPv6 google access type for VMs. If not specified, use INHERIT_FROM_SUBNETWORK as default.
     &quot;reservationAffinity&quot;: { # Specifies the reservations that this instance can consume from. # Specifies the reservations that instances can consume from.
       &quot;consumeReservationType&quot;: &quot;A String&quot;, # Specifies the type of reservation from which this instance can consume resources: ANY_RESERVATION (default), SPECIFIC_RESERVATION, or NO_RESERVATION. See Consuming reserved instances for examples.
diff --git a/docs/dyn/compute_alpha.regionInstantSnapshots.html b/docs/dyn/compute_alpha.regionInstantSnapshots.html
index d09dbe9..a4f176d 100644
--- a/docs/dyn/compute_alpha.regionInstantSnapshots.html
+++ b/docs/dyn/compute_alpha.regionInstantSnapshots.html
@@ -194,10 +194,10 @@
     &quot;baseInstantSnapshot&quot;: &quot;A String&quot;, # An optional base instant snapshot that this resource is compared against. If not specified, all blocks of this resource are exported. The base instant snapshot and this resource must be created from the same disk. The base instant snapshot must be created earlier in time than this resource.
     &quot;bucketName&quot;: &quot;A String&quot;, # The name of an existing bucket in Cloud Storage where the changed blocks will be stored. The Google Service Account must have read and write access to this bucket. The bucket has to be in the same region as this resource.
     &quot;encryptionKey&quot;: { # Encryption key used to encrypt the instant snapshot.
-      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
       &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
     },
     &quot;objectName&quot;: &quot;A String&quot;, # Name of the output Bigstore object storing the changed blocks. Object name must be less than 1024 bytes in length.
diff --git a/docs/dyn/compute_alpha.regionNetworkFirewallPolicies.html b/docs/dyn/compute_alpha.regionNetworkFirewallPolicies.html
index 9a69972..5f431ce 100644
--- a/docs/dyn/compute_alpha.regionNetworkFirewallPolicies.html
+++ b/docs/dyn/compute_alpha.regionNetworkFirewallPolicies.html
@@ -694,7 +694,7 @@
         &quot;enable&quot;: True or False, # This field denotes whether to enable logging for a particular firewall rule.
         &quot;metadata&quot;: &quot;A String&quot;, # This field can only be specified for a particular firewall rule if logging is enabled for that rule. This field denotes whether to include or exclude metadata for firewall logs.
       },
-      &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+      &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
       &quot;network&quot;: &quot;A String&quot;, # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
       &quot;priority&quot;: 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
diff --git a/docs/dyn/compute_alpha.routers.html b/docs/dyn/compute_alpha.routers.html
index 8201ad8..a7c5a45 100644
--- a/docs/dyn/compute_alpha.routers.html
+++ b/docs/dyn/compute_alpha.routers.html
@@ -637,6 +637,14 @@
     &quot;bestRoutes&quot;: [ # Best routes for this router&#x27;s network.
       { # Represents a Route resource. A route defines a path from VM instances in the VPC network to a specific destination. This destination can be inside or outside the VPC network. For more information, read the Routes overview.
         &quot;allowConflictingSubnetworks&quot;: True or False, # Whether this route can conflict with existing subnetworks. Setting this to true allows this route to conflict with subnetworks that have already been configured on the corresponding network.
+        &quot;asPaths&quot;: [ # [Output Only] AS path.
+          {
+            &quot;asLists&quot;: [ # [Output Only] The AS numbers of the AS Path.
+              42,
+            ],
+            &quot;pathSegmentType&quot;: &quot;A String&quot;, # [Output Only] The type of the AS Path, which can be one of the following values: - &#x27;AS_SET&#x27;: unordered set of autonomous systems that the route in has traversed - &#x27;AS_SEQUENCE&#x27;: ordered set of autonomous systems that the route has traversed - &#x27;AS_CONFED_SEQUENCE&#x27;: ordered set of Member Autonomous Systems in the local confederation that the route has traversed - &#x27;AS_CONFED_SET&#x27;: unordered set of Member Autonomous Systems in the local confederation that the route has traversed
+          },
+        ],
         &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
         &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this field when you create the resource.
         &quot;destRange&quot;: &quot;A String&quot;, # The destination range of outgoing packets that this route applies to. Both IPv4 and IPv6 are supported.
@@ -654,6 +662,7 @@
         &quot;nextHopPeering&quot;: &quot;A String&quot;, # [Output Only] The network peering name that should handle matching packets, which should conform to RFC1035.
         &quot;nextHopVpnTunnel&quot;: &quot;A String&quot;, # The URL to a VpnTunnel that should handle matching packets.
         &quot;priority&quot;: 42, # The priority of this route. Priority is used to break ties in cases where there is more than one matching route of equal prefix length. In cases where multiple routes have equal prefix length, the one with the lowest-numbered priority value wins. The default value is `1000`. The priority value must be from `0` to `65535`, inclusive.
+        &quot;routeType&quot;: &quot;A String&quot;, # [Output Only] The type of this route, which can be one of the following values: - &#x27;TRANSIT&#x27; for a transit route that this router learned from another Cloud Router and will readvertise to one of its BGP peers - &#x27;SUBNET&#x27; for a route from a subnet of the VPC - &#x27;BGP&#x27; for a route learned from a BGP peer of this router - &#x27;STATIC&#x27; for a static route
         &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined fully-qualified URL for this resource.
         &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource with the resource id.
         &quot;tags&quot;: [ # A list of instance tags to which this route applies.
@@ -676,6 +685,14 @@
     &quot;bestRoutesForRouter&quot;: [ # Best routes learned by this router.
       { # Represents a Route resource. A route defines a path from VM instances in the VPC network to a specific destination. This destination can be inside or outside the VPC network. For more information, read the Routes overview.
         &quot;allowConflictingSubnetworks&quot;: True or False, # Whether this route can conflict with existing subnetworks. Setting this to true allows this route to conflict with subnetworks that have already been configured on the corresponding network.
+        &quot;asPaths&quot;: [ # [Output Only] AS path.
+          {
+            &quot;asLists&quot;: [ # [Output Only] The AS numbers of the AS Path.
+              42,
+            ],
+            &quot;pathSegmentType&quot;: &quot;A String&quot;, # [Output Only] The type of the AS Path, which can be one of the following values: - &#x27;AS_SET&#x27;: unordered set of autonomous systems that the route in has traversed - &#x27;AS_SEQUENCE&#x27;: ordered set of autonomous systems that the route has traversed - &#x27;AS_CONFED_SEQUENCE&#x27;: ordered set of Member Autonomous Systems in the local confederation that the route has traversed - &#x27;AS_CONFED_SET&#x27;: unordered set of Member Autonomous Systems in the local confederation that the route has traversed
+          },
+        ],
         &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
         &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this field when you create the resource.
         &quot;destRange&quot;: &quot;A String&quot;, # The destination range of outgoing packets that this route applies to. Both IPv4 and IPv6 are supported.
@@ -693,6 +710,7 @@
         &quot;nextHopPeering&quot;: &quot;A String&quot;, # [Output Only] The network peering name that should handle matching packets, which should conform to RFC1035.
         &quot;nextHopVpnTunnel&quot;: &quot;A String&quot;, # The URL to a VpnTunnel that should handle matching packets.
         &quot;priority&quot;: 42, # The priority of this route. Priority is used to break ties in cases where there is more than one matching route of equal prefix length. In cases where multiple routes have equal prefix length, the one with the lowest-numbered priority value wins. The default value is `1000`. The priority value must be from `0` to `65535`, inclusive.
+        &quot;routeType&quot;: &quot;A String&quot;, # [Output Only] The type of this route, which can be one of the following values: - &#x27;TRANSIT&#x27; for a transit route that this router learned from another Cloud Router and will readvertise to one of its BGP peers - &#x27;SUBNET&#x27; for a route from a subnet of the VPC - &#x27;BGP&#x27; for a route learned from a BGP peer of this router - &#x27;STATIC&#x27; for a static route
         &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined fully-qualified URL for this resource.
         &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource with the resource id.
         &quot;tags&quot;: [ # A list of instance tags to which this route applies.
@@ -717,6 +735,14 @@
         &quot;advertisedRoutes&quot;: [ # Routes that were advertised to the remote BGP peer
           { # Represents a Route resource. A route defines a path from VM instances in the VPC network to a specific destination. This destination can be inside or outside the VPC network. For more information, read the Routes overview.
             &quot;allowConflictingSubnetworks&quot;: True or False, # Whether this route can conflict with existing subnetworks. Setting this to true allows this route to conflict with subnetworks that have already been configured on the corresponding network.
+            &quot;asPaths&quot;: [ # [Output Only] AS path.
+              {
+                &quot;asLists&quot;: [ # [Output Only] The AS numbers of the AS Path.
+                  42,
+                ],
+                &quot;pathSegmentType&quot;: &quot;A String&quot;, # [Output Only] The type of the AS Path, which can be one of the following values: - &#x27;AS_SET&#x27;: unordered set of autonomous systems that the route in has traversed - &#x27;AS_SEQUENCE&#x27;: ordered set of autonomous systems that the route has traversed - &#x27;AS_CONFED_SEQUENCE&#x27;: ordered set of Member Autonomous Systems in the local confederation that the route has traversed - &#x27;AS_CONFED_SET&#x27;: unordered set of Member Autonomous Systems in the local confederation that the route has traversed
+              },
+            ],
             &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
             &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this field when you create the resource.
             &quot;destRange&quot;: &quot;A String&quot;, # The destination range of outgoing packets that this route applies to. Both IPv4 and IPv6 are supported.
@@ -734,6 +760,7 @@
             &quot;nextHopPeering&quot;: &quot;A String&quot;, # [Output Only] The network peering name that should handle matching packets, which should conform to RFC1035.
             &quot;nextHopVpnTunnel&quot;: &quot;A String&quot;, # The URL to a VpnTunnel that should handle matching packets.
             &quot;priority&quot;: 42, # The priority of this route. Priority is used to break ties in cases where there is more than one matching route of equal prefix length. In cases where multiple routes have equal prefix length, the one with the lowest-numbered priority value wins. The default value is `1000`. The priority value must be from `0` to `65535`, inclusive.
+            &quot;routeType&quot;: &quot;A String&quot;, # [Output Only] The type of this route, which can be one of the following values: - &#x27;TRANSIT&#x27; for a transit route that this router learned from another Cloud Router and will readvertise to one of its BGP peers - &#x27;SUBNET&#x27; for a route from a subnet of the VPC - &#x27;BGP&#x27; for a route learned from a BGP peer of this router - &#x27;STATIC&#x27; for a static route
             &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined fully-qualified URL for this resource.
             &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource with the resource id.
             &quot;tags&quot;: [ # A list of instance tags to which this route applies.
diff --git a/docs/dyn/compute_alpha.routes.html b/docs/dyn/compute_alpha.routes.html
index 70a81d5..1c056f3 100644
--- a/docs/dyn/compute_alpha.routes.html
+++ b/docs/dyn/compute_alpha.routes.html
@@ -182,6 +182,14 @@
 
     { # Represents a Route resource. A route defines a path from VM instances in the VPC network to a specific destination. This destination can be inside or outside the VPC network. For more information, read the Routes overview.
   &quot;allowConflictingSubnetworks&quot;: True or False, # Whether this route can conflict with existing subnetworks. Setting this to true allows this route to conflict with subnetworks that have already been configured on the corresponding network.
+  &quot;asPaths&quot;: [ # [Output Only] AS path.
+    {
+      &quot;asLists&quot;: [ # [Output Only] The AS numbers of the AS Path.
+        42,
+      ],
+      &quot;pathSegmentType&quot;: &quot;A String&quot;, # [Output Only] The type of the AS Path, which can be one of the following values: - &#x27;AS_SET&#x27;: unordered set of autonomous systems that the route in has traversed - &#x27;AS_SEQUENCE&#x27;: ordered set of autonomous systems that the route has traversed - &#x27;AS_CONFED_SEQUENCE&#x27;: ordered set of Member Autonomous Systems in the local confederation that the route has traversed - &#x27;AS_CONFED_SET&#x27;: unordered set of Member Autonomous Systems in the local confederation that the route has traversed
+    },
+  ],
   &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
   &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this field when you create the resource.
   &quot;destRange&quot;: &quot;A String&quot;, # The destination range of outgoing packets that this route applies to. Both IPv4 and IPv6 are supported.
@@ -199,6 +207,7 @@
   &quot;nextHopPeering&quot;: &quot;A String&quot;, # [Output Only] The network peering name that should handle matching packets, which should conform to RFC1035.
   &quot;nextHopVpnTunnel&quot;: &quot;A String&quot;, # The URL to a VpnTunnel that should handle matching packets.
   &quot;priority&quot;: 42, # The priority of this route. Priority is used to break ties in cases where there is more than one matching route of equal prefix length. In cases where multiple routes have equal prefix length, the one with the lowest-numbered priority value wins. The default value is `1000`. The priority value must be from `0` to `65535`, inclusive.
+  &quot;routeType&quot;: &quot;A String&quot;, # [Output Only] The type of this route, which can be one of the following values: - &#x27;TRANSIT&#x27; for a transit route that this router learned from another Cloud Router and will readvertise to one of its BGP peers - &#x27;SUBNET&#x27; for a route from a subnet of the VPC - &#x27;BGP&#x27; for a route learned from a BGP peer of this router - &#x27;STATIC&#x27; for a static route
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined fully-qualified URL for this resource.
   &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource with the resource id.
   &quot;tags&quot;: [ # A list of instance tags to which this route applies.
@@ -230,6 +239,14 @@
 
 { # Represents a Route resource. A route defines a path from VM instances in the VPC network to a specific destination. This destination can be inside or outside the VPC network. For more information, read the Routes overview.
   &quot;allowConflictingSubnetworks&quot;: True or False, # Whether this route can conflict with existing subnetworks. Setting this to true allows this route to conflict with subnetworks that have already been configured on the corresponding network.
+  &quot;asPaths&quot;: [ # [Output Only] AS path.
+    {
+      &quot;asLists&quot;: [ # [Output Only] The AS numbers of the AS Path.
+        42,
+      ],
+      &quot;pathSegmentType&quot;: &quot;A String&quot;, # [Output Only] The type of the AS Path, which can be one of the following values: - &#x27;AS_SET&#x27;: unordered set of autonomous systems that the route in has traversed - &#x27;AS_SEQUENCE&#x27;: ordered set of autonomous systems that the route has traversed - &#x27;AS_CONFED_SEQUENCE&#x27;: ordered set of Member Autonomous Systems in the local confederation that the route has traversed - &#x27;AS_CONFED_SET&#x27;: unordered set of Member Autonomous Systems in the local confederation that the route has traversed
+    },
+  ],
   &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
   &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this field when you create the resource.
   &quot;destRange&quot;: &quot;A String&quot;, # The destination range of outgoing packets that this route applies to. Both IPv4 and IPv6 are supported.
@@ -247,6 +264,7 @@
   &quot;nextHopPeering&quot;: &quot;A String&quot;, # [Output Only] The network peering name that should handle matching packets, which should conform to RFC1035.
   &quot;nextHopVpnTunnel&quot;: &quot;A String&quot;, # The URL to a VpnTunnel that should handle matching packets.
   &quot;priority&quot;: 42, # The priority of this route. Priority is used to break ties in cases where there is more than one matching route of equal prefix length. In cases where multiple routes have equal prefix length, the one with the lowest-numbered priority value wins. The default value is `1000`. The priority value must be from `0` to `65535`, inclusive.
+  &quot;routeType&quot;: &quot;A String&quot;, # [Output Only] The type of this route, which can be one of the following values: - &#x27;TRANSIT&#x27; for a transit route that this router learned from another Cloud Router and will readvertise to one of its BGP peers - &#x27;SUBNET&#x27; for a route from a subnet of the VPC - &#x27;BGP&#x27; for a route learned from a BGP peer of this router - &#x27;STATIC&#x27; for a static route
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined fully-qualified URL for this resource.
   &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource with the resource id.
   &quot;tags&quot;: [ # A list of instance tags to which this route applies.
@@ -347,6 +365,14 @@
   &quot;items&quot;: [ # A list of Route resources.
     { # Represents a Route resource. A route defines a path from VM instances in the VPC network to a specific destination. This destination can be inside or outside the VPC network. For more information, read the Routes overview.
       &quot;allowConflictingSubnetworks&quot;: True or False, # Whether this route can conflict with existing subnetworks. Setting this to true allows this route to conflict with subnetworks that have already been configured on the corresponding network.
+      &quot;asPaths&quot;: [ # [Output Only] AS path.
+        {
+          &quot;asLists&quot;: [ # [Output Only] The AS numbers of the AS Path.
+            42,
+          ],
+          &quot;pathSegmentType&quot;: &quot;A String&quot;, # [Output Only] The type of the AS Path, which can be one of the following values: - &#x27;AS_SET&#x27;: unordered set of autonomous systems that the route in has traversed - &#x27;AS_SEQUENCE&#x27;: ordered set of autonomous systems that the route has traversed - &#x27;AS_CONFED_SEQUENCE&#x27;: ordered set of Member Autonomous Systems in the local confederation that the route has traversed - &#x27;AS_CONFED_SET&#x27;: unordered set of Member Autonomous Systems in the local confederation that the route has traversed
+        },
+      ],
       &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
       &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this field when you create the resource.
       &quot;destRange&quot;: &quot;A String&quot;, # The destination range of outgoing packets that this route applies to. Both IPv4 and IPv6 are supported.
@@ -364,6 +390,7 @@
       &quot;nextHopPeering&quot;: &quot;A String&quot;, # [Output Only] The network peering name that should handle matching packets, which should conform to RFC1035.
       &quot;nextHopVpnTunnel&quot;: &quot;A String&quot;, # The URL to a VpnTunnel that should handle matching packets.
       &quot;priority&quot;: 42, # The priority of this route. Priority is used to break ties in cases where there is more than one matching route of equal prefix length. In cases where multiple routes have equal prefix length, the one with the lowest-numbered priority value wins. The default value is `1000`. The priority value must be from `0` to `65535`, inclusive.
+      &quot;routeType&quot;: &quot;A String&quot;, # [Output Only] The type of this route, which can be one of the following values: - &#x27;TRANSIT&#x27; for a transit route that this router learned from another Cloud Router and will readvertise to one of its BGP peers - &#x27;SUBNET&#x27; for a route from a subnet of the VPC - &#x27;BGP&#x27; for a route learned from a BGP peer of this router - &#x27;STATIC&#x27; for a static route
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined fully-qualified URL for this resource.
       &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource with the resource id.
       &quot;tags&quot;: [ # A list of instance tags to which this route applies.
diff --git a/docs/dyn/compute_alpha.snapshots.html b/docs/dyn/compute_alpha.snapshots.html
index 6f95c57..7473b7d 100644
--- a/docs/dyn/compute_alpha.snapshots.html
+++ b/docs/dyn/compute_alpha.snapshots.html
@@ -220,18 +220,18 @@
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource&#x27;s resource id.
   &quot;snapshotEncryptionKey&quot;: { # Encrypts the snapshot using a customer-supplied encryption key. After you encrypt a snapshot using a customer-supplied key, you must provide the same key if you use the snapshot later. For example, you must provide the encryption key when you create a disk from the encrypted snapshot in a future request. Customer-supplied encryption keys do not protect access to metadata of the snapshot. If you do not provide an encryption key when creating the snapshot, then the snapshot will be encrypted using an automatically generated key and you do not need to provide a key to use the snapshot later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDisk&quot;: &quot;A String&quot;, # The source disk used to create this snapshot.
   &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this snapshot. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given disk name.
@@ -393,18 +393,18 @@
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource&#x27;s resource id.
   &quot;snapshotEncryptionKey&quot;: { # Encrypts the snapshot using a customer-supplied encryption key. After you encrypt a snapshot using a customer-supplied key, you must provide the same key if you use the snapshot later. For example, you must provide the encryption key when you create a disk from the encrypted snapshot in a future request. Customer-supplied encryption keys do not protect access to metadata of the snapshot. If you do not provide an encryption key when creating the snapshot, then the snapshot will be encrypted using an automatically generated key and you do not need to provide a key to use the snapshot later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDisk&quot;: &quot;A String&quot;, # The source disk used to create this snapshot.
   &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this snapshot. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given disk name.
@@ -531,18 +531,18 @@
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
       &quot;selfLinkWithId&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for this resource&#x27;s resource id.
       &quot;snapshotEncryptionKey&quot;: { # Encrypts the snapshot using a customer-supplied encryption key. After you encrypt a snapshot using a customer-supplied key, you must provide the same key if you use the snapshot later. For example, you must provide the encryption key when you create a disk from the encrypted snapshot in a future request. Customer-supplied encryption keys do not protect access to metadata of the snapshot. If you do not provide an encryption key when creating the snapshot, then the snapshot will be encrypted using an automatically generated key and you do not need to provide a key to use the snapshot later.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceDisk&quot;: &quot;A String&quot;, # The source disk used to create this snapshot.
       &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this snapshot. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given disk name.
diff --git a/docs/dyn/compute_beta.backendServices.html b/docs/dyn/compute_beta.backendServices.html
index 63c6b5d..56030e0 100644
--- a/docs/dyn/compute_beta.backendServices.html
+++ b/docs/dyn/compute_beta.backendServices.html
@@ -301,8 +301,8 @@
           },
           &quot;connectionTrackingPolicy&quot;: { # Connection Tracking configuration for this BackendService.
             &quot;connectionPersistenceOnUnhealthyBackends&quot;: &quot;A String&quot;, # Specifies connection persistence when backends are unhealthy. The default value is DEFAULT_FOR_PROTOCOL. If set to DEFAULT_FOR_PROTOCOL, the existing connections persist on unhealthy backends only for connection-oriented protocols (TCP and SCTP) and only if the Tracking Mode is PER_CONNECTION (default tracking mode) or the Session Affinity is configured for 5-tuple. They do not persist for UDP. If set to NEVER_PERSIST, after a backend becomes unhealthy, the existing connections on the unhealthy backend are never persisted on the unhealthy backend. They are always diverted to newly selected healthy backends (unless all backends are unhealthy). If set to ALWAYS_PERSIST, existing connections always persist on unhealthy backends regardless of protocol and session affinity. It is generally not recommended to use this mode overriding the default.
-            &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity. This is only available in External TCP/UDP load balancer.
-            &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For NLB the minimum(default) is 60 seconds and the maximum is 16 hours. This field will be supported only if the Connection Tracking key is less than 5-tuple.
+            &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity for Network Load Balancing. This option is not available publicly.
+            &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For Network Load Balancer the default is 60 seconds. This option is not available publicly. This field will be supported only if the Connection Tracking key is less than 5-tuple.
             &quot;trackingMode&quot;: &quot;A String&quot;, # Specifies the key used for connection tracking. There are two options: PER_CONNECTION: This is the default mode. The Connection Tracking is performed as per the Connection Key (default Hash Method) for the specific protocol. PER_SESSION: The Connection Tracking is performed as per the configured Session Affinity. It matches the configured Session Affinity.
           },
           &quot;consistentHash&quot;: { # This message defines settings for a consistent hash style load balancer. # Consistent Hash-based load balancing can be used to provide soft session affinity based on HTTP headers, cookies or other properties. This load balancing policy is applicable only for HTTP connections. The affinity to a particular destination host will be lost when one or more hosts are added/removed from the destination service. This field specifies parameters that control consistent hashing. This field is only applicable when localityLbPolicy is set to MAGLEV or RING_HASH. This field is applicable to either: - A regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2, and load_balancing_scheme set to INTERNAL_MANAGED. - A global backend service with the load_balancing_scheme set to INTERNAL_SELF_MANAGED. Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
@@ -663,8 +663,8 @@
   },
   &quot;connectionTrackingPolicy&quot;: { # Connection Tracking configuration for this BackendService.
     &quot;connectionPersistenceOnUnhealthyBackends&quot;: &quot;A String&quot;, # Specifies connection persistence when backends are unhealthy. The default value is DEFAULT_FOR_PROTOCOL. If set to DEFAULT_FOR_PROTOCOL, the existing connections persist on unhealthy backends only for connection-oriented protocols (TCP and SCTP) and only if the Tracking Mode is PER_CONNECTION (default tracking mode) or the Session Affinity is configured for 5-tuple. They do not persist for UDP. If set to NEVER_PERSIST, after a backend becomes unhealthy, the existing connections on the unhealthy backend are never persisted on the unhealthy backend. They are always diverted to newly selected healthy backends (unless all backends are unhealthy). If set to ALWAYS_PERSIST, existing connections always persist on unhealthy backends regardless of protocol and session affinity. It is generally not recommended to use this mode overriding the default.
-    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity. This is only available in External TCP/UDP load balancer.
-    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For NLB the minimum(default) is 60 seconds and the maximum is 16 hours. This field will be supported only if the Connection Tracking key is less than 5-tuple.
+    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity for Network Load Balancing. This option is not available publicly.
+    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For Network Load Balancer the default is 60 seconds. This option is not available publicly. This field will be supported only if the Connection Tracking key is less than 5-tuple.
     &quot;trackingMode&quot;: &quot;A String&quot;, # Specifies the key used for connection tracking. There are two options: PER_CONNECTION: This is the default mode. The Connection Tracking is performed as per the Connection Key (default Hash Method) for the specific protocol. PER_SESSION: The Connection Tracking is performed as per the configured Session Affinity. It matches the configured Session Affinity.
   },
   &quot;consistentHash&quot;: { # This message defines settings for a consistent hash style load balancer. # Consistent Hash-based load balancing can be used to provide soft session affinity based on HTTP headers, cookies or other properties. This load balancing policy is applicable only for HTTP connections. The affinity to a particular destination host will be lost when one or more hosts are added/removed from the destination service. This field specifies parameters that control consistent hashing. This field is only applicable when localityLbPolicy is set to MAGLEV or RING_HASH. This field is applicable to either: - A regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2, and load_balancing_scheme set to INTERNAL_MANAGED. - A global backend service with the load_balancing_scheme set to INTERNAL_SELF_MANAGED. Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
@@ -992,8 +992,8 @@
   },
   &quot;connectionTrackingPolicy&quot;: { # Connection Tracking configuration for this BackendService.
     &quot;connectionPersistenceOnUnhealthyBackends&quot;: &quot;A String&quot;, # Specifies connection persistence when backends are unhealthy. The default value is DEFAULT_FOR_PROTOCOL. If set to DEFAULT_FOR_PROTOCOL, the existing connections persist on unhealthy backends only for connection-oriented protocols (TCP and SCTP) and only if the Tracking Mode is PER_CONNECTION (default tracking mode) or the Session Affinity is configured for 5-tuple. They do not persist for UDP. If set to NEVER_PERSIST, after a backend becomes unhealthy, the existing connections on the unhealthy backend are never persisted on the unhealthy backend. They are always diverted to newly selected healthy backends (unless all backends are unhealthy). If set to ALWAYS_PERSIST, existing connections always persist on unhealthy backends regardless of protocol and session affinity. It is generally not recommended to use this mode overriding the default.
-    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity. This is only available in External TCP/UDP load balancer.
-    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For NLB the minimum(default) is 60 seconds and the maximum is 16 hours. This field will be supported only if the Connection Tracking key is less than 5-tuple.
+    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity for Network Load Balancing. This option is not available publicly.
+    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For Network Load Balancer the default is 60 seconds. This option is not available publicly. This field will be supported only if the Connection Tracking key is less than 5-tuple.
     &quot;trackingMode&quot;: &quot;A String&quot;, # Specifies the key used for connection tracking. There are two options: PER_CONNECTION: This is the default mode. The Connection Tracking is performed as per the Connection Key (default Hash Method) for the specific protocol. PER_SESSION: The Connection Tracking is performed as per the configured Session Affinity. It matches the configured Session Affinity.
   },
   &quot;consistentHash&quot;: { # This message defines settings for a consistent hash style load balancer. # Consistent Hash-based load balancing can be used to provide soft session affinity based on HTTP headers, cookies or other properties. This load balancing policy is applicable only for HTTP connections. The affinity to a particular destination host will be lost when one or more hosts are added/removed from the destination service. This field specifies parameters that control consistent hashing. This field is only applicable when localityLbPolicy is set to MAGLEV or RING_HASH. This field is applicable to either: - A regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2, and load_balancing_scheme set to INTERNAL_MANAGED. - A global backend service with the load_balancing_scheme set to INTERNAL_SELF_MANAGED. Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
@@ -1240,8 +1240,8 @@
       },
       &quot;connectionTrackingPolicy&quot;: { # Connection Tracking configuration for this BackendService.
         &quot;connectionPersistenceOnUnhealthyBackends&quot;: &quot;A String&quot;, # Specifies connection persistence when backends are unhealthy. The default value is DEFAULT_FOR_PROTOCOL. If set to DEFAULT_FOR_PROTOCOL, the existing connections persist on unhealthy backends only for connection-oriented protocols (TCP and SCTP) and only if the Tracking Mode is PER_CONNECTION (default tracking mode) or the Session Affinity is configured for 5-tuple. They do not persist for UDP. If set to NEVER_PERSIST, after a backend becomes unhealthy, the existing connections on the unhealthy backend are never persisted on the unhealthy backend. They are always diverted to newly selected healthy backends (unless all backends are unhealthy). If set to ALWAYS_PERSIST, existing connections always persist on unhealthy backends regardless of protocol and session affinity. It is generally not recommended to use this mode overriding the default.
-        &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity. This is only available in External TCP/UDP load balancer.
-        &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For NLB the minimum(default) is 60 seconds and the maximum is 16 hours. This field will be supported only if the Connection Tracking key is less than 5-tuple.
+        &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity for Network Load Balancing. This option is not available publicly.
+        &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For Network Load Balancer the default is 60 seconds. This option is not available publicly. This field will be supported only if the Connection Tracking key is less than 5-tuple.
         &quot;trackingMode&quot;: &quot;A String&quot;, # Specifies the key used for connection tracking. There are two options: PER_CONNECTION: This is the default mode. The Connection Tracking is performed as per the Connection Key (default Hash Method) for the specific protocol. PER_SESSION: The Connection Tracking is performed as per the configured Session Affinity. It matches the configured Session Affinity.
       },
       &quot;consistentHash&quot;: { # This message defines settings for a consistent hash style load balancer. # Consistent Hash-based load balancing can be used to provide soft session affinity based on HTTP headers, cookies or other properties. This load balancing policy is applicable only for HTTP connections. The affinity to a particular destination host will be lost when one or more hosts are added/removed from the destination service. This field specifies parameters that control consistent hashing. This field is only applicable when localityLbPolicy is set to MAGLEV or RING_HASH. This field is applicable to either: - A regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2, and load_balancing_scheme set to INTERNAL_MANAGED. - A global backend service with the load_balancing_scheme set to INTERNAL_SELF_MANAGED. Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
@@ -1450,8 +1450,8 @@
   },
   &quot;connectionTrackingPolicy&quot;: { # Connection Tracking configuration for this BackendService.
     &quot;connectionPersistenceOnUnhealthyBackends&quot;: &quot;A String&quot;, # Specifies connection persistence when backends are unhealthy. The default value is DEFAULT_FOR_PROTOCOL. If set to DEFAULT_FOR_PROTOCOL, the existing connections persist on unhealthy backends only for connection-oriented protocols (TCP and SCTP) and only if the Tracking Mode is PER_CONNECTION (default tracking mode) or the Session Affinity is configured for 5-tuple. They do not persist for UDP. If set to NEVER_PERSIST, after a backend becomes unhealthy, the existing connections on the unhealthy backend are never persisted on the unhealthy backend. They are always diverted to newly selected healthy backends (unless all backends are unhealthy). If set to ALWAYS_PERSIST, existing connections always persist on unhealthy backends regardless of protocol and session affinity. It is generally not recommended to use this mode overriding the default.
-    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity. This is only available in External TCP/UDP load balancer.
-    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For NLB the minimum(default) is 60 seconds and the maximum is 16 hours. This field will be supported only if the Connection Tracking key is less than 5-tuple.
+    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity for Network Load Balancing. This option is not available publicly.
+    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For Network Load Balancer the default is 60 seconds. This option is not available publicly. This field will be supported only if the Connection Tracking key is less than 5-tuple.
     &quot;trackingMode&quot;: &quot;A String&quot;, # Specifies the key used for connection tracking. There are two options: PER_CONNECTION: This is the default mode. The Connection Tracking is performed as per the Connection Key (default Hash Method) for the specific protocol. PER_SESSION: The Connection Tracking is performed as per the configured Session Affinity. It matches the configured Session Affinity.
   },
   &quot;consistentHash&quot;: { # This message defines settings for a consistent hash style load balancer. # Consistent Hash-based load balancing can be used to provide soft session affinity based on HTTP headers, cookies or other properties. This load balancing policy is applicable only for HTTP connections. The affinity to a particular destination host will be lost when one or more hosts are added/removed from the destination service. This field specifies parameters that control consistent hashing. This field is only applicable when localityLbPolicy is set to MAGLEV or RING_HASH. This field is applicable to either: - A regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2, and load_balancing_scheme set to INTERNAL_MANAGED. - A global backend service with the load_balancing_scheme set to INTERNAL_SELF_MANAGED. Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
@@ -2068,8 +2068,8 @@
   },
   &quot;connectionTrackingPolicy&quot;: { # Connection Tracking configuration for this BackendService.
     &quot;connectionPersistenceOnUnhealthyBackends&quot;: &quot;A String&quot;, # Specifies connection persistence when backends are unhealthy. The default value is DEFAULT_FOR_PROTOCOL. If set to DEFAULT_FOR_PROTOCOL, the existing connections persist on unhealthy backends only for connection-oriented protocols (TCP and SCTP) and only if the Tracking Mode is PER_CONNECTION (default tracking mode) or the Session Affinity is configured for 5-tuple. They do not persist for UDP. If set to NEVER_PERSIST, after a backend becomes unhealthy, the existing connections on the unhealthy backend are never persisted on the unhealthy backend. They are always diverted to newly selected healthy backends (unless all backends are unhealthy). If set to ALWAYS_PERSIST, existing connections always persist on unhealthy backends regardless of protocol and session affinity. It is generally not recommended to use this mode overriding the default.
-    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity. This is only available in External TCP/UDP load balancer.
-    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For NLB the minimum(default) is 60 seconds and the maximum is 16 hours. This field will be supported only if the Connection Tracking key is less than 5-tuple.
+    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity for Network Load Balancing. This option is not available publicly.
+    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For Network Load Balancer the default is 60 seconds. This option is not available publicly. This field will be supported only if the Connection Tracking key is less than 5-tuple.
     &quot;trackingMode&quot;: &quot;A String&quot;, # Specifies the key used for connection tracking. There are two options: PER_CONNECTION: This is the default mode. The Connection Tracking is performed as per the Connection Key (default Hash Method) for the specific protocol. PER_SESSION: The Connection Tracking is performed as per the configured Session Affinity. It matches the configured Session Affinity.
   },
   &quot;consistentHash&quot;: { # This message defines settings for a consistent hash style load balancer. # Consistent Hash-based load balancing can be used to provide soft session affinity based on HTTP headers, cookies or other properties. This load balancing policy is applicable only for HTTP connections. The affinity to a particular destination host will be lost when one or more hosts are added/removed from the destination service. This field specifies parameters that control consistent hashing. This field is only applicable when localityLbPolicy is set to MAGLEV or RING_HASH. This field is applicable to either: - A regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2, and load_balancing_scheme set to INTERNAL_MANAGED. - A global backend service with the load_balancing_scheme set to INTERNAL_SELF_MANAGED. Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
diff --git a/docs/dyn/compute_beta.disks.html b/docs/dyn/compute_beta.disks.html
index 38e5b07..e9f30d1 100644
--- a/docs/dyn/compute_beta.disks.html
+++ b/docs/dyn/compute_beta.disks.html
@@ -228,10 +228,10 @@
           &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
           &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
           &quot;diskEncryptionKey&quot;: { # Encrypts the disk using a customer-supplied encryption key or a customer-managed encryption key. Encryption keys do not protect access to metadata of the disk. After you encrypt a disk with a customer-supplied key, you must provide the same key if you use the disk later. For example, to create a disk snapshot, to create a disk image, to create a machine image, or to attach the disk to a virtual machine. After you encrypt a disk with a customer-managed key, the diskEncryptionKey.kmsKeyName is set to a key *version* name once the disk is created. The disk is encrypted with this version of the key. In the response, diskEncryptionKey.kmsKeyName appears in the following format: &quot;diskEncryptionKey.kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key /cryptoKeysVersions/version If you do not provide an encryption key when creating the disk, then the disk is encrypted using an automatically generated key and you don&#x27;t need to provide a key to use the disk later.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;eraseWindowsVssSignature&quot;: True or False, # Specifies whether the disk restored from a source snapshot should erase Windows specific VSS signature.
@@ -276,19 +276,19 @@
           &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the disk used to create this disk. This value identifies the exact disk that was used to create this persistent disk. For example, if you created the persistent disk from a disk that was later deleted and recreated under the same name, the source disk ID would identify the exact version of the disk that was used.
           &quot;sourceImage&quot;: &quot;A String&quot;, # The source image used to create this disk. If the source image is deleted, this field will not be set. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family
           &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
           &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/snapshots/snapshot - projects/project/global/snapshots/snapshot - global/snapshots/snapshot
           &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.
@@ -391,18 +391,18 @@
   &quot;satisfiesPzs&quot;: True or False, # [Output Only] Reserved for future use.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;snapshotEncryptionKey&quot;: { # Encrypts the snapshot using a customer-supplied encryption key. After you encrypt a snapshot using a customer-supplied key, you must provide the same key if you use the snapshot later. For example, you must provide the encryption key when you create a disk from the encrypted snapshot in a future request. Customer-supplied encryption keys do not protect access to metadata of the snapshot. If you do not provide an encryption key when creating the snapshot, then the snapshot will be encrypted using an automatically generated key and you do not need to provide a key to use the snapshot later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDisk&quot;: &quot;A String&quot;, # The source disk used to create this snapshot.
   &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this snapshot. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given disk name.
@@ -558,10 +558,10 @@
   &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
   &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
   &quot;diskEncryptionKey&quot;: { # Encrypts the disk using a customer-supplied encryption key or a customer-managed encryption key. Encryption keys do not protect access to metadata of the disk. After you encrypt a disk with a customer-supplied key, you must provide the same key if you use the disk later. For example, to create a disk snapshot, to create a disk image, to create a machine image, or to attach the disk to a virtual machine. After you encrypt a disk with a customer-managed key, the diskEncryptionKey.kmsKeyName is set to a key *version* name once the disk is created. The disk is encrypted with this version of the key. In the response, diskEncryptionKey.kmsKeyName appears in the following format: &quot;diskEncryptionKey.kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key /cryptoKeysVersions/version If you do not provide an encryption key when creating the disk, then the disk is encrypted using an automatically generated key and you don&#x27;t need to provide a key to use the disk later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;eraseWindowsVssSignature&quot;: True or False, # Specifies whether the disk restored from a source snapshot should erase Windows specific VSS signature.
@@ -606,19 +606,19 @@
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the disk used to create this disk. This value identifies the exact disk that was used to create this persistent disk. For example, if you created the persistent disk from a disk that was later deleted and recreated under the same name, the source disk ID would identify the exact version of the disk that was used.
   &quot;sourceImage&quot;: &quot;A String&quot;, # The source image used to create this disk. If the source image is deleted, this field will not be set. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family
   &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
   &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/snapshots/snapshot - projects/project/global/snapshots/snapshot - global/snapshots/snapshot
   &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.
@@ -755,10 +755,10 @@
   &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
   &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
   &quot;diskEncryptionKey&quot;: { # Encrypts the disk using a customer-supplied encryption key or a customer-managed encryption key. Encryption keys do not protect access to metadata of the disk. After you encrypt a disk with a customer-supplied key, you must provide the same key if you use the disk later. For example, to create a disk snapshot, to create a disk image, to create a machine image, or to attach the disk to a virtual machine. After you encrypt a disk with a customer-managed key, the diskEncryptionKey.kmsKeyName is set to a key *version* name once the disk is created. The disk is encrypted with this version of the key. In the response, diskEncryptionKey.kmsKeyName appears in the following format: &quot;diskEncryptionKey.kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key /cryptoKeysVersions/version If you do not provide an encryption key when creating the disk, then the disk is encrypted using an automatically generated key and you don&#x27;t need to provide a key to use the disk later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;eraseWindowsVssSignature&quot;: True or False, # Specifies whether the disk restored from a source snapshot should erase Windows specific VSS signature.
@@ -803,19 +803,19 @@
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the disk used to create this disk. This value identifies the exact disk that was used to create this persistent disk. For example, if you created the persistent disk from a disk that was later deleted and recreated under the same name, the source disk ID would identify the exact version of the disk that was used.
   &quot;sourceImage&quot;: &quot;A String&quot;, # The source image used to create this disk. If the source image is deleted, this field will not be set. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family
   &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
   &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/snapshots/snapshot - projects/project/global/snapshots/snapshot - global/snapshots/snapshot
   &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.
@@ -916,10 +916,10 @@
       &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
       &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
       &quot;diskEncryptionKey&quot;: { # Encrypts the disk using a customer-supplied encryption key or a customer-managed encryption key. Encryption keys do not protect access to metadata of the disk. After you encrypt a disk with a customer-supplied key, you must provide the same key if you use the disk later. For example, to create a disk snapshot, to create a disk image, to create a machine image, or to attach the disk to a virtual machine. After you encrypt a disk with a customer-managed key, the diskEncryptionKey.kmsKeyName is set to a key *version* name once the disk is created. The disk is encrypted with this version of the key. In the response, diskEncryptionKey.kmsKeyName appears in the following format: &quot;diskEncryptionKey.kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key /cryptoKeysVersions/version If you do not provide an encryption key when creating the disk, then the disk is encrypted using an automatically generated key and you don&#x27;t need to provide a key to use the disk later.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;eraseWindowsVssSignature&quot;: True or False, # Specifies whether the disk restored from a source snapshot should erase Windows specific VSS signature.
@@ -964,19 +964,19 @@
       &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the disk used to create this disk. This value identifies the exact disk that was used to create this persistent disk. For example, if you created the persistent disk from a disk that was later deleted and recreated under the same name, the source disk ID would identify the exact version of the disk that was used.
       &quot;sourceImage&quot;: &quot;A String&quot;, # The source image used to create this disk. If the source image is deleted, this field will not be set. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family
       &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
       &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/snapshots/snapshot - projects/project/global/snapshots/snapshot - global/snapshots/snapshot
       &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.
@@ -1500,10 +1500,10 @@
   &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
   &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
   &quot;diskEncryptionKey&quot;: { # Encrypts the disk using a customer-supplied encryption key or a customer-managed encryption key. Encryption keys do not protect access to metadata of the disk. After you encrypt a disk with a customer-supplied key, you must provide the same key if you use the disk later. For example, to create a disk snapshot, to create a disk image, to create a machine image, or to attach the disk to a virtual machine. After you encrypt a disk with a customer-managed key, the diskEncryptionKey.kmsKeyName is set to a key *version* name once the disk is created. The disk is encrypted with this version of the key. In the response, diskEncryptionKey.kmsKeyName appears in the following format: &quot;diskEncryptionKey.kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key /cryptoKeysVersions/version If you do not provide an encryption key when creating the disk, then the disk is encrypted using an automatically generated key and you don&#x27;t need to provide a key to use the disk later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;eraseWindowsVssSignature&quot;: True or False, # Specifies whether the disk restored from a source snapshot should erase Windows specific VSS signature.
@@ -1548,19 +1548,19 @@
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the disk used to create this disk. This value identifies the exact disk that was used to create this persistent disk. For example, if you created the persistent disk from a disk that was later deleted and recreated under the same name, the source disk ID would identify the exact version of the disk that was used.
   &quot;sourceImage&quot;: &quot;A String&quot;, # The source image used to create this disk. If the source image is deleted, this field will not be set. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family
   &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
   &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/snapshots/snapshot - projects/project/global/snapshots/snapshot - global/snapshots/snapshot
   &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.
diff --git a/docs/dyn/compute_beta.firewalls.html b/docs/dyn/compute_beta.firewalls.html
index e36f173..e069554 100644
--- a/docs/dyn/compute_beta.firewalls.html
+++ b/docs/dyn/compute_beta.firewalls.html
@@ -216,7 +216,7 @@
     &quot;enable&quot;: True or False, # This field denotes whether to enable logging for a particular firewall rule.
     &quot;metadata&quot;: &quot;A String&quot;, # This field can only be specified for a particular firewall rule if logging is enabled for that rule. This field denotes whether to include or exclude metadata for firewall logs.
   },
-  &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+  &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
   &quot;network&quot;: &quot;A String&quot;, # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
   &quot;priority&quot;: 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
@@ -278,7 +278,7 @@
     &quot;enable&quot;: True or False, # This field denotes whether to enable logging for a particular firewall rule.
     &quot;metadata&quot;: &quot;A String&quot;, # This field can only be specified for a particular firewall rule if logging is enabled for that rule. This field denotes whether to include or exclude metadata for firewall logs.
   },
-  &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+  &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
   &quot;network&quot;: &quot;A String&quot;, # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
   &quot;priority&quot;: 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
@@ -408,7 +408,7 @@
         &quot;enable&quot;: True or False, # This field denotes whether to enable logging for a particular firewall rule.
         &quot;metadata&quot;: &quot;A String&quot;, # This field can only be specified for a particular firewall rule if logging is enabled for that rule. This field denotes whether to include or exclude metadata for firewall logs.
       },
-      &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+      &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
       &quot;network&quot;: &quot;A String&quot;, # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
       &quot;priority&quot;: 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
@@ -500,7 +500,7 @@
     &quot;enable&quot;: True or False, # This field denotes whether to enable logging for a particular firewall rule.
     &quot;metadata&quot;: &quot;A String&quot;, # This field can only be specified for a particular firewall rule if logging is enabled for that rule. This field denotes whether to include or exclude metadata for firewall logs.
   },
-  &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+  &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
   &quot;network&quot;: &quot;A String&quot;, # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
   &quot;priority&quot;: 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
@@ -649,7 +649,7 @@
     &quot;enable&quot;: True or False, # This field denotes whether to enable logging for a particular firewall rule.
     &quot;metadata&quot;: &quot;A String&quot;, # This field can only be specified for a particular firewall rule if logging is enabled for that rule. This field denotes whether to include or exclude metadata for firewall logs.
   },
-  &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+  &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
   &quot;network&quot;: &quot;A String&quot;, # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
   &quot;priority&quot;: 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
diff --git a/docs/dyn/compute_beta.globalOperations.html b/docs/dyn/compute_beta.globalOperations.html
index 62cf22f..16b01e4 100644
--- a/docs/dyn/compute_beta.globalOperations.html
+++ b/docs/dyn/compute_beta.globalOperations.html
@@ -88,7 +88,7 @@
 <p class="firstline">Deletes the specified Operations resource.</p>
 <p class="toc_element">
   <code><a href="#get">get(project, operation, x__xgafv=None)</a></code></p>
-<p class="firstline">Retrieves the specified Operations resource. Gets a list of operations by making a `list()` request.</p>
+<p class="firstline">Retrieves the specified Operations resource.</p>
 <p class="toc_element">
   <code><a href="#list">list(project, filter=None, maxResults=None, orderBy=None, pageToken=None, returnPartialSuccess=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Retrieves a list of Operation resources contained within the specified project.</p>
@@ -236,7 +236,7 @@
 
 <div class="method">
     <code class="details" id="get">get(project, operation, x__xgafv=None)</code>
-  <pre>Retrieves the specified Operations resource. Gets a list of operations by making a `list()` request.
+  <pre>Retrieves the specified Operations resource.
 
 Args:
   project: string, Project ID for this request. (required)
diff --git a/docs/dyn/compute_beta.imageFamilyViews.html b/docs/dyn/compute_beta.imageFamilyViews.html
index 5844fb2..8388156 100644
--- a/docs/dyn/compute_beta.imageFamilyViews.html
+++ b/docs/dyn/compute_beta.imageFamilyViews.html
@@ -129,10 +129,10 @@
     ],
     &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
     &quot;imageEncryptionKey&quot;: { # Encrypts the image using a customer-supplied encryption key. After you encrypt an image with a customer-supplied key, you must provide the same key if you use the image later (e.g. to create a disk from the image). Customer-supplied encryption keys do not protect access to metadata of the disk. If you do not provide an encryption key when creating the image, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the image later.
-      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
       &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
     },
     &quot;kind&quot;: &quot;compute#image&quot;, # [Output Only] Type of the resource. Always compute#image for images.
@@ -187,28 +187,28 @@
     },
     &quot;sourceDisk&quot;: &quot;A String&quot;, # URL of the source disk used to create this image. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /disks/disk - projects/project/zones/zone/disks/disk - zones/zone/disks/disk In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
     &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
       &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
     },
     &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
     &quot;sourceImage&quot;: &quot;A String&quot;, # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
     &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
       &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
     },
     &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
     &quot;sourceSnapshot&quot;: &quot;A String&quot;, # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
     &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
       &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
     },
     &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the snapshot used to create this image. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given snapshot name.
diff --git a/docs/dyn/compute_beta.images.html b/docs/dyn/compute_beta.images.html
index ecf148e..fd99882 100644
--- a/docs/dyn/compute_beta.images.html
+++ b/docs/dyn/compute_beta.images.html
@@ -303,10 +303,10 @@
   ],
   &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
   &quot;imageEncryptionKey&quot;: { # Encrypts the image using a customer-supplied encryption key. After you encrypt an image with a customer-supplied key, you must provide the same key if you use the image later (e.g. to create a disk from the image). Customer-supplied encryption keys do not protect access to metadata of the disk. If you do not provide an encryption key when creating the image, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the image later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;kind&quot;: &quot;compute#image&quot;, # [Output Only] Type of the resource. Always compute#image for images.
@@ -361,28 +361,28 @@
   },
   &quot;sourceDisk&quot;: &quot;A String&quot;, # URL of the source disk used to create this image. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /disks/disk - projects/project/zones/zone/disks/disk - zones/zone/disks/disk In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
   &quot;sourceImage&quot;: &quot;A String&quot;, # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
   &quot;sourceSnapshot&quot;: &quot;A String&quot;, # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the snapshot used to create this image. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given snapshot name.
@@ -438,10 +438,10 @@
   ],
   &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
   &quot;imageEncryptionKey&quot;: { # Encrypts the image using a customer-supplied encryption key. After you encrypt an image with a customer-supplied key, you must provide the same key if you use the image later (e.g. to create a disk from the image). Customer-supplied encryption keys do not protect access to metadata of the disk. If you do not provide an encryption key when creating the image, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the image later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;kind&quot;: &quot;compute#image&quot;, # [Output Only] Type of the resource. Always compute#image for images.
@@ -496,28 +496,28 @@
   },
   &quot;sourceDisk&quot;: &quot;A String&quot;, # URL of the source disk used to create this image. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /disks/disk - projects/project/zones/zone/disks/disk - zones/zone/disks/disk In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
   &quot;sourceImage&quot;: &quot;A String&quot;, # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
   &quot;sourceSnapshot&quot;: &quot;A String&quot;, # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the snapshot used to create this image. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given snapshot name.
@@ -671,10 +671,10 @@
   ],
   &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
   &quot;imageEncryptionKey&quot;: { # Encrypts the image using a customer-supplied encryption key. After you encrypt an image with a customer-supplied key, you must provide the same key if you use the image later (e.g. to create a disk from the image). Customer-supplied encryption keys do not protect access to metadata of the disk. If you do not provide an encryption key when creating the image, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the image later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;kind&quot;: &quot;compute#image&quot;, # [Output Only] Type of the resource. Always compute#image for images.
@@ -729,28 +729,28 @@
   },
   &quot;sourceDisk&quot;: &quot;A String&quot;, # URL of the source disk used to create this image. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /disks/disk - projects/project/zones/zone/disks/disk - zones/zone/disks/disk In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
   &quot;sourceImage&quot;: &quot;A String&quot;, # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
   &quot;sourceSnapshot&quot;: &quot;A String&quot;, # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the snapshot used to create this image. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given snapshot name.
@@ -869,10 +869,10 @@
       ],
       &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
       &quot;imageEncryptionKey&quot;: { # Encrypts the image using a customer-supplied encryption key. After you encrypt an image with a customer-supplied key, you must provide the same key if you use the image later (e.g. to create a disk from the image). Customer-supplied encryption keys do not protect access to metadata of the disk. If you do not provide an encryption key when creating the image, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the image later.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;kind&quot;: &quot;compute#image&quot;, # [Output Only] Type of the resource. Always compute#image for images.
@@ -927,28 +927,28 @@
       },
       &quot;sourceDisk&quot;: &quot;A String&quot;, # URL of the source disk used to create this image. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /disks/disk - projects/project/zones/zone/disks/disk - zones/zone/disks/disk In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
       &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
       &quot;sourceImage&quot;: &quot;A String&quot;, # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
       &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
       &quot;sourceSnapshot&quot;: &quot;A String&quot;, # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
       &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the snapshot used to create this image. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given snapshot name.
@@ -1028,10 +1028,10 @@
   ],
   &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
   &quot;imageEncryptionKey&quot;: { # Encrypts the image using a customer-supplied encryption key. After you encrypt an image with a customer-supplied key, you must provide the same key if you use the image later (e.g. to create a disk from the image). Customer-supplied encryption keys do not protect access to metadata of the disk. If you do not provide an encryption key when creating the image, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the image later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;kind&quot;: &quot;compute#image&quot;, # [Output Only] Type of the resource. Always compute#image for images.
@@ -1086,28 +1086,28 @@
   },
   &quot;sourceDisk&quot;: &quot;A String&quot;, # URL of the source disk used to create this image. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /disks/disk - projects/project/zones/zone/disks/disk - zones/zone/disks/disk In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
   &quot;sourceImage&quot;: &quot;A String&quot;, # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
   &quot;sourceSnapshot&quot;: &quot;A String&quot;, # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the snapshot used to create this image. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given snapshot name.
diff --git a/docs/dyn/compute_beta.instanceGroupManagers.html b/docs/dyn/compute_beta.instanceGroupManagers.html
index 7dc477a..807481e 100644
--- a/docs/dyn/compute_beta.instanceGroupManagers.html
+++ b/docs/dyn/compute_beta.instanceGroupManagers.html
@@ -133,7 +133,7 @@
 <p class="firstline">Retrieves the next page of results.</p>
 <p class="toc_element">
   <code><a href="#patch">patch(project, zone, instanceGroupManager, body=None, requestId=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is patched even if the instances in the group are still in the process of being patched. You must separately verify the status of the individual instances with the listManagedInstances method. This method supports PATCH semantics and uses the JSON merge patch format and processing rules.</p>
+<p class="firstline">Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is patched even if the instances in the group are still in the process of being patched. You must separately verify the status of the individual instances with the listManagedInstances method. This method supports PATCH semantics and uses the JSON merge patch format and processing rules. If you update your group to specify a new template or instance configuration, it's possible that your intended specification for each VM in the group is different from the current state of that VM. To learn how to apply an updated configuration to the VMs in a MIG, see Updating instances in a MIG.</p>
 <p class="toc_element">
   <code><a href="#patchPerInstanceConfigs">patchPerInstanceConfigs(project, zone, instanceGroupManager, body=None, requestId=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Inserts or patches per-instance configs for the managed instance group. perInstanceConfig.name serves as a key used to distinguish whether to perform insert or patch.</p>
@@ -160,7 +160,7 @@
 <p class="firstline">Returns permissions that a caller has on the specified resource.</p>
 <p class="toc_element">
   <code><a href="#update">update(project, zone, instanceGroupManager, body=None, requestId=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is updated even if the instances in the group have not yet been updated. You must separately verify the status of the individual instances with the listManagedInstances method.</p>
+<p class="firstline">Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is updated even if the instances in the group have not yet been updated. You must separately verify the status of the individual instances with the listManagedInstances method. If you update your group to specify a new template or instance configuration, it's possible that your intended specification for each VM in the group is different from the current state of that VM. To learn how to apply an updated configuration to the VMs in a MIG, see Updating instances in a MIG.</p>
 <p class="toc_element">
   <code><a href="#updatePerInstanceConfigs">updatePerInstanceConfigs(project, zone, instanceGroupManager, body=None, requestId=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Inserts or updates per-instance configs for the managed instance group. perInstanceConfig.name serves as a key used to distinguish whether to perform insert or patch.</p>
@@ -1460,7 +1460,7 @@
 
 <div class="method">
     <code class="details" id="patch">patch(project, zone, instanceGroupManager, body=None, requestId=None, x__xgafv=None)</code>
-  <pre>Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is patched even if the instances in the group are still in the process of being patched. You must separately verify the status of the individual instances with the listManagedInstances method. This method supports PATCH semantics and uses the JSON merge patch format and processing rules.
+  <pre>Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is patched even if the instances in the group are still in the process of being patched. You must separately verify the status of the individual instances with the listManagedInstances method. This method supports PATCH semantics and uses the JSON merge patch format and processing rules. If you update your group to specify a new template or instance configuration, it&#x27;s possible that your intended specification for each VM in the group is different from the current state of that VM. To learn how to apply an updated configuration to the VMs in a MIG, see Updating instances in a MIG.
 
 Args:
   project: string, Project ID for this request. (required)
@@ -2183,7 +2183,7 @@
 
 <div class="method">
     <code class="details" id="update">update(project, zone, instanceGroupManager, body=None, requestId=None, x__xgafv=None)</code>
-  <pre>Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is updated even if the instances in the group have not yet been updated. You must separately verify the status of the individual instances with the listManagedInstances method.
+  <pre>Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is updated even if the instances in the group have not yet been updated. You must separately verify the status of the individual instances with the listManagedInstances method. If you update your group to specify a new template or instance configuration, it&#x27;s possible that your intended specification for each VM in the group is different from the current state of that VM. To learn how to apply an updated configuration to the VMs in a MIG, see Updating instances in a MIG.
 
 Args:
   project: string, Project ID for this request. (required)
diff --git a/docs/dyn/compute_beta.instanceTemplates.html b/docs/dyn/compute_beta.instanceTemplates.html
index f63bb14..22f3230 100644
--- a/docs/dyn/compute_beta.instanceTemplates.html
+++ b/docs/dyn/compute_beta.instanceTemplates.html
@@ -207,10 +207,10 @@
         &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
         &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
         &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -241,18 +241,18 @@
           ],
           &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
           &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
           &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
         },
@@ -368,7 +368,7 @@
     &quot;networkPerformanceConfig&quot;: {
       &quot;totalEgressBandwidthTier&quot;: &quot;A String&quot;,
     },
-    &quot;postKeyRevocationActionType&quot;: &quot;A String&quot;, # PostKeyRevocationActionType of the instance.
+    &quot;postKeyRevocationActionType&quot;: &quot;A String&quot;, # PostKeyRevocationActionType of the instance.(will be deprecated soon)
     &quot;privateIpv6GoogleAccess&quot;: &quot;A String&quot;, # The private IPv6 google access type for VMs. If not specified, use INHERIT_FROM_SUBNETWORK as default.
     &quot;reservationAffinity&quot;: { # Specifies the reservations that this instance can consume from. # Specifies the reservations that instances can consume from.
       &quot;consumeReservationType&quot;: &quot;A String&quot;, # Specifies the type of reservation from which this instance can consume resources: ANY_RESERVATION (default), SPECIFIC_RESERVATION, or NO_RESERVATION. See Consuming reserved instances for examples.
@@ -576,10 +576,10 @@
         &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
         &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
         &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -610,18 +610,18 @@
           ],
           &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
           &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
           &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
         },
@@ -737,7 +737,7 @@
     &quot;networkPerformanceConfig&quot;: {
       &quot;totalEgressBandwidthTier&quot;: &quot;A String&quot;,
     },
-    &quot;postKeyRevocationActionType&quot;: &quot;A String&quot;, # PostKeyRevocationActionType of the instance.
+    &quot;postKeyRevocationActionType&quot;: &quot;A String&quot;, # PostKeyRevocationActionType of the instance.(will be deprecated soon)
     &quot;privateIpv6GoogleAccess&quot;: &quot;A String&quot;, # The private IPv6 google access type for VMs. If not specified, use INHERIT_FROM_SUBNETWORK as default.
     &quot;reservationAffinity&quot;: { # Specifies the reservations that this instance can consume from. # Specifies the reservations that instances can consume from.
       &quot;consumeReservationType&quot;: &quot;A String&quot;, # Specifies the type of reservation from which this instance can consume resources: ANY_RESERVATION (default), SPECIFIC_RESERVATION, or NO_RESERVATION. See Consuming reserved instances for examples.
@@ -909,10 +909,10 @@
             &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
             &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
             &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-              &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-              &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-              &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-              &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+              &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+              &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+              &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+              &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
               &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
             },
             &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -943,18 +943,18 @@
               ],
               &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
               &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-                &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-                &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-                &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-                &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+                &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+                &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+                &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+                &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
                 &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
               },
               &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
               &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-                &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-                &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-                &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-                &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+                &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+                &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+                &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+                &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
                 &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
               },
             },
@@ -1070,7 +1070,7 @@
         &quot;networkPerformanceConfig&quot;: {
           &quot;totalEgressBandwidthTier&quot;: &quot;A String&quot;,
         },
-        &quot;postKeyRevocationActionType&quot;: &quot;A String&quot;, # PostKeyRevocationActionType of the instance.
+        &quot;postKeyRevocationActionType&quot;: &quot;A String&quot;, # PostKeyRevocationActionType of the instance.(will be deprecated soon)
         &quot;privateIpv6GoogleAccess&quot;: &quot;A String&quot;, # The private IPv6 google access type for VMs. If not specified, use INHERIT_FROM_SUBNETWORK as default.
         &quot;reservationAffinity&quot;: { # Specifies the reservations that this instance can consume from. # Specifies the reservations that instances can consume from.
           &quot;consumeReservationType&quot;: &quot;A String&quot;, # Specifies the type of reservation from which this instance can consume resources: ANY_RESERVATION (default), SPECIFIC_RESERVATION, or NO_RESERVATION. See Consuming reserved instances for examples.
diff --git a/docs/dyn/compute_beta.instances.html b/docs/dyn/compute_beta.instances.html
index a9c8c34..444595c 100644
--- a/docs/dyn/compute_beta.instances.html
+++ b/docs/dyn/compute_beta.instances.html
@@ -82,7 +82,7 @@
 <p class="firstline">Adds existing resource policies to an instance. You can only add one policy right now which will be applied to this instance for scheduling live migrations.</p>
 <p class="toc_element">
   <code><a href="#aggregatedList">aggregatedList(project, filter=None, includeAllScopes=None, maxResults=None, orderBy=None, pageToken=None, returnPartialSuccess=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Retrieves aggregated list of all of the instances in your project across all regions and zones.</p>
+<p class="firstline">Retrieves an aggregated list of all of the instances in your project across all regions and zones. The performance of this method degrades when a filter is specified on a project that has a very large number of instances.</p>
 <p class="toc_element">
   <code><a href="#aggregatedList_next">aggregatedList_next(previous_request, previous_response)</a></code></p>
 <p class="firstline">Retrieves the next page of results.</p>
@@ -389,7 +389,7 @@
 
 <div class="method">
     <code class="details" id="aggregatedList">aggregatedList(project, filter=None, includeAllScopes=None, maxResults=None, orderBy=None, pageToken=None, returnPartialSuccess=None, x__xgafv=None)</code>
-  <pre>Retrieves aggregated list of all of the instances in your project across all regions and zones.
+  <pre>Retrieves an aggregated list of all of the instances in your project across all regions and zones. The performance of this method degrades when a filter is specified on a project that has a very large number of instances.
 
 Args:
   project: string, Project ID for this request. (required)
@@ -431,10 +431,10 @@
               &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
               &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
               &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-                &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-                &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-                &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-                &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+                &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+                &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+                &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+                &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
                 &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
               },
               &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -465,18 +465,18 @@
                 ],
                 &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
                 &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-                  &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-                  &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-                  &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-                  &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+                  &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+                  &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+                  &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+                  &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
                   &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
                 },
                 &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
                 &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-                  &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-                  &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-                  &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-                  &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+                  &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+                  &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+                  &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+                  &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
                   &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
                 },
               },
@@ -663,10 +663,10 @@
           },
           &quot;sourceMachineImage&quot;: &quot;A String&quot;, # Source machine image
           &quot;sourceMachineImageEncryptionKey&quot;: { # Source machine image encryption key when creating an instance from a machine image.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;startRestricted&quot;: True or False, # [Output Only] Whether a VM has been restricted for start because Compute Engine has detected suspicious activity.
@@ -742,10 +742,10 @@
   &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
   &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
   &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -776,18 +776,18 @@
     ],
     &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
     &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
       &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
     },
     &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
     &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
       &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
     },
   },
@@ -914,10 +914,10 @@
         &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
         &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
         &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -948,18 +948,18 @@
           ],
           &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
           &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
           &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
         },
@@ -1075,7 +1075,7 @@
     &quot;networkPerformanceConfig&quot;: {
       &quot;totalEgressBandwidthTier&quot;: &quot;A String&quot;,
     },
-    &quot;postKeyRevocationActionType&quot;: &quot;A String&quot;, # PostKeyRevocationActionType of the instance.
+    &quot;postKeyRevocationActionType&quot;: &quot;A String&quot;, # PostKeyRevocationActionType of the instance.(will be deprecated soon)
     &quot;privateIpv6GoogleAccess&quot;: &quot;A String&quot;, # The private IPv6 google access type for VMs. If not specified, use INHERIT_FROM_SUBNETWORK as default.
     &quot;reservationAffinity&quot;: { # Specifies the reservations that this instance can consume from. # Specifies the reservations that instances can consume from.
       &quot;consumeReservationType&quot;: &quot;A String&quot;, # Specifies the type of reservation from which this instance can consume resources: ANY_RESERVATION (default), SPECIFIC_RESERVATION, or NO_RESERVATION. See Consuming reserved instances for examples.
@@ -1441,10 +1441,10 @@
       &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
       &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
       &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -1475,18 +1475,18 @@
         ],
         &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
         &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
         &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
       },
@@ -1673,10 +1673,10 @@
   },
   &quot;sourceMachineImage&quot;: &quot;A String&quot;, # Source machine image
   &quot;sourceMachineImageEncryptionKey&quot;: { # Source machine image encryption key when creating an instance from a machine image.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;startRestricted&quot;: True or False, # [Output Only] Whether a VM has been restricted for start because Compute Engine has detected suspicious activity.
@@ -1784,7 +1784,7 @@
         &quot;enable&quot;: True or False, # This field denotes whether to enable logging for a particular firewall rule.
         &quot;metadata&quot;: &quot;A String&quot;, # This field can only be specified for a particular firewall rule if logging is enabled for that rule. This field denotes whether to include or exclude metadata for firewall logs.
       },
-      &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+      &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
       &quot;network&quot;: &quot;A String&quot;, # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
       &quot;priority&quot;: 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
@@ -2161,10 +2161,10 @@
       &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
       &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
       &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -2195,18 +2195,18 @@
         ],
         &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
         &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
         &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
       },
@@ -2393,10 +2393,10 @@
   },
   &quot;sourceMachineImage&quot;: &quot;A String&quot;, # Source machine image
   &quot;sourceMachineImageEncryptionKey&quot;: { # Source machine image encryption key when creating an instance from a machine image.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;startRestricted&quot;: True or False, # [Output Only] Whether a VM has been restricted for start because Compute Engine has detected suspicious activity.
@@ -2511,10 +2511,10 @@
           &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
           &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
           &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -2545,18 +2545,18 @@
             ],
             &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
             &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-              &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-              &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-              &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-              &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+              &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+              &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+              &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+              &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
               &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
             },
             &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
             &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-              &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-              &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-              &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-              &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+              &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+              &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+              &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+              &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
               &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
             },
           },
@@ -2743,10 +2743,10 @@
       },
       &quot;sourceMachineImage&quot;: &quot;A String&quot;, # Source machine image
       &quot;sourceMachineImageEncryptionKey&quot;: { # Source machine image encryption key when creating an instance from a machine image.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;startRestricted&quot;: True or False, # [Output Only] Whether a VM has been restricted for start because Compute Engine has detected suspicious activity.
@@ -3004,20 +3004,20 @@
   &quot;disks&quot;: [ # Array of disks associated with this instance that are protected with a customer-supplied encryption key. In order to resume the instance, the disk url and its corresponding key must be provided. If the disk is not protected with a customer-supplied encryption key it should not be specified.
     {
       &quot;diskEncryptionKey&quot;: { # Decrypts data associated with the disk with a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
-      &quot;source&quot;: &quot;A String&quot;, # Specifies a valid partial or full URL to an existing Persistent Disk resource. This field is only applicable for persistent disks.
+      &quot;source&quot;: &quot;A String&quot;, # Specifies a valid partial or full URL to an existing Persistent Disk resource. This field is only applicable for persistent disks. For example: &quot;source&quot;: &quot;/compute/v1/projects/project_id/zones/zone/disks/ disk_name
     },
   ],
   &quot;instanceEncryptionKey&quot;: { # Decrypts data associated with an instance that is protected with a customer-supplied encryption key. If the instance you are starting is protected with a customer-supplied encryption key, the correct key must be provided otherwise the instance resume will not succeed.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
 }
@@ -4399,13 +4399,13 @@
   &quot;disks&quot;: [ # Array of disks associated with this instance that are protected with a customer-supplied encryption key. In order to start the instance, the disk url and its corresponding key must be provided. If the disk is not protected with a customer-supplied encryption key it should not be specified.
     {
       &quot;diskEncryptionKey&quot;: { # Decrypts data associated with the disk with a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
-      &quot;source&quot;: &quot;A String&quot;, # Specifies a valid partial or full URL to an existing Persistent Disk resource. This field is only applicable for persistent disks.
+      &quot;source&quot;: &quot;A String&quot;, # Specifies a valid partial or full URL to an existing Persistent Disk resource. This field is only applicable for persistent disks. For example: &quot;source&quot;: &quot;/compute/v1/projects/project_id/zones/zone/disks/ disk_name
     },
   ],
 }
@@ -4657,10 +4657,10 @@
       &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
       &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
       &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -4691,18 +4691,18 @@
         ],
         &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
         &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
         &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
       },
@@ -4889,10 +4889,10 @@
   },
   &quot;sourceMachineImage&quot;: &quot;A String&quot;, # Source machine image
   &quot;sourceMachineImageEncryptionKey&quot;: { # Source machine image encryption key when creating an instance from a machine image.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;startRestricted&quot;: True or False, # [Output Only] Whether a VM has been restricted for start because Compute Engine has detected suspicious activity.
diff --git a/docs/dyn/compute_beta.interconnectAttachments.html b/docs/dyn/compute_beta.interconnectAttachments.html
index 892b3df..d966019 100644
--- a/docs/dyn/compute_beta.interconnectAttachments.html
+++ b/docs/dyn/compute_beta.interconnectAttachments.html
@@ -172,6 +172,7 @@
           },
           &quot;region&quot;: &quot;A String&quot;, # [Output Only] URL of the region where the regional interconnect attachment resides. You must specify this field as part of the HTTP request URL. It is not settable as a field in the request body.
           &quot;router&quot;: &quot;A String&quot;, # URL of the Cloud Router to be used for dynamic routing. This router must be in the same region as this InterconnectAttachment. The InterconnectAttachment will automatically connect the Interconnect to the network &amp; region within which the Cloud Router is configured.
+          &quot;satisfiesPzs&quot;: True or False, # [Output Only] Set to true if the resource satisfies the zone separation organization policy constraints and false otherwise. Defaults to false if the field is not present.
           &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
           &quot;state&quot;: &quot;A String&quot;, # [Output Only] The current state of this attachment&#x27;s functionality. Enum values ACTIVE and UNPROVISIONED are shared by DEDICATED/PRIVATE, PARTNER, and PARTNER_PROVIDER interconnect attachments, while enum values PENDING_PARTNER, PARTNER_REQUEST_RECEIVED, and PENDING_CUSTOMER are used for only PARTNER and PARTNER_PROVIDER interconnect attachments. This state can take one of the following values: - ACTIVE: The attachment has been turned up and is ready to use. - UNPROVISIONED: The attachment is not ready to use yet, because turnup is not complete. - PENDING_PARTNER: A newly-created PARTNER attachment that has not yet been configured on the Partner side. - PARTNER_REQUEST_RECEIVED: A PARTNER attachment is in the process of provisioning after a PARTNER_PROVIDER attachment was created that references it. - PENDING_CUSTOMER: A PARTNER or PARTNER_PROVIDER attachment that is waiting for a customer to activate it. - DEFUNCT: The attachment was deleted externally and is no longer functional. This could be because the associated Interconnect was removed, or because the other side of a Partner attachment was deleted.
           &quot;type&quot;: &quot;A String&quot;, # The type of interconnect attachment this is, which can take one of the following values: - DEDICATED: an attachment to a Dedicated Interconnect. - PARTNER: an attachment to a Partner Interconnect, created by the customer. - PARTNER_PROVIDER: an attachment to a Partner Interconnect, created by the partner.
@@ -347,6 +348,7 @@
   },
   &quot;region&quot;: &quot;A String&quot;, # [Output Only] URL of the region where the regional interconnect attachment resides. You must specify this field as part of the HTTP request URL. It is not settable as a field in the request body.
   &quot;router&quot;: &quot;A String&quot;, # URL of the Cloud Router to be used for dynamic routing. This router must be in the same region as this InterconnectAttachment. The InterconnectAttachment will automatically connect the Interconnect to the network &amp; region within which the Cloud Router is configured.
+  &quot;satisfiesPzs&quot;: True or False, # [Output Only] Set to true if the resource satisfies the zone separation organization policy constraints and false otherwise. Defaults to false if the field is not present.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;state&quot;: &quot;A String&quot;, # [Output Only] The current state of this attachment&#x27;s functionality. Enum values ACTIVE and UNPROVISIONED are shared by DEDICATED/PRIVATE, PARTNER, and PARTNER_PROVIDER interconnect attachments, while enum values PENDING_PARTNER, PARTNER_REQUEST_RECEIVED, and PENDING_CUSTOMER are used for only PARTNER and PARTNER_PROVIDER interconnect attachments. This state can take one of the following values: - ACTIVE: The attachment has been turned up and is ready to use. - UNPROVISIONED: The attachment is not ready to use yet, because turnup is not complete. - PENDING_PARTNER: A newly-created PARTNER attachment that has not yet been configured on the Partner side. - PARTNER_REQUEST_RECEIVED: A PARTNER attachment is in the process of provisioning after a PARTNER_PROVIDER attachment was created that references it. - PENDING_CUSTOMER: A PARTNER or PARTNER_PROVIDER attachment that is waiting for a customer to activate it. - DEFUNCT: The attachment was deleted externally and is no longer functional. This could be because the associated Interconnect was removed, or because the other side of a Partner attachment was deleted.
   &quot;type&quot;: &quot;A String&quot;, # The type of interconnect attachment this is, which can take one of the following values: - DEDICATED: an attachment to a Dedicated Interconnect. - PARTNER: an attachment to a Partner Interconnect, created by the customer. - PARTNER_PROVIDER: an attachment to a Partner Interconnect, created by the partner.
@@ -403,6 +405,7 @@
   },
   &quot;region&quot;: &quot;A String&quot;, # [Output Only] URL of the region where the regional interconnect attachment resides. You must specify this field as part of the HTTP request URL. It is not settable as a field in the request body.
   &quot;router&quot;: &quot;A String&quot;, # URL of the Cloud Router to be used for dynamic routing. This router must be in the same region as this InterconnectAttachment. The InterconnectAttachment will automatically connect the Interconnect to the network &amp; region within which the Cloud Router is configured.
+  &quot;satisfiesPzs&quot;: True or False, # [Output Only] Set to true if the resource satisfies the zone separation organization policy constraints and false otherwise. Defaults to false if the field is not present.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;state&quot;: &quot;A String&quot;, # [Output Only] The current state of this attachment&#x27;s functionality. Enum values ACTIVE and UNPROVISIONED are shared by DEDICATED/PRIVATE, PARTNER, and PARTNER_PROVIDER interconnect attachments, while enum values PENDING_PARTNER, PARTNER_REQUEST_RECEIVED, and PENDING_CUSTOMER are used for only PARTNER and PARTNER_PROVIDER interconnect attachments. This state can take one of the following values: - ACTIVE: The attachment has been turned up and is ready to use. - UNPROVISIONED: The attachment is not ready to use yet, because turnup is not complete. - PENDING_PARTNER: A newly-created PARTNER attachment that has not yet been configured on the Partner side. - PARTNER_REQUEST_RECEIVED: A PARTNER attachment is in the process of provisioning after a PARTNER_PROVIDER attachment was created that references it. - PENDING_CUSTOMER: A PARTNER or PARTNER_PROVIDER attachment that is waiting for a customer to activate it. - DEFUNCT: The attachment was deleted externally and is no longer functional. This could be because the associated Interconnect was removed, or because the other side of a Partner attachment was deleted.
   &quot;type&quot;: &quot;A String&quot;, # The type of interconnect attachment this is, which can take one of the following values: - DEDICATED: an attachment to a Dedicated Interconnect. - PARTNER: an attachment to a Partner Interconnect, created by the customer. - PARTNER_PROVIDER: an attachment to a Partner Interconnect, created by the partner.
@@ -528,6 +531,7 @@
       },
       &quot;region&quot;: &quot;A String&quot;, # [Output Only] URL of the region where the regional interconnect attachment resides. You must specify this field as part of the HTTP request URL. It is not settable as a field in the request body.
       &quot;router&quot;: &quot;A String&quot;, # URL of the Cloud Router to be used for dynamic routing. This router must be in the same region as this InterconnectAttachment. The InterconnectAttachment will automatically connect the Interconnect to the network &amp; region within which the Cloud Router is configured.
+      &quot;satisfiesPzs&quot;: True or False, # [Output Only] Set to true if the resource satisfies the zone separation organization policy constraints and false otherwise. Defaults to false if the field is not present.
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
       &quot;state&quot;: &quot;A String&quot;, # [Output Only] The current state of this attachment&#x27;s functionality. Enum values ACTIVE and UNPROVISIONED are shared by DEDICATED/PRIVATE, PARTNER, and PARTNER_PROVIDER interconnect attachments, while enum values PENDING_PARTNER, PARTNER_REQUEST_RECEIVED, and PENDING_CUSTOMER are used for only PARTNER and PARTNER_PROVIDER interconnect attachments. This state can take one of the following values: - ACTIVE: The attachment has been turned up and is ready to use. - UNPROVISIONED: The attachment is not ready to use yet, because turnup is not complete. - PENDING_PARTNER: A newly-created PARTNER attachment that has not yet been configured on the Partner side. - PARTNER_REQUEST_RECEIVED: A PARTNER attachment is in the process of provisioning after a PARTNER_PROVIDER attachment was created that references it. - PENDING_CUSTOMER: A PARTNER or PARTNER_PROVIDER attachment that is waiting for a customer to activate it. - DEFUNCT: The attachment was deleted externally and is no longer functional. This could be because the associated Interconnect was removed, or because the other side of a Partner attachment was deleted.
       &quot;type&quot;: &quot;A String&quot;, # The type of interconnect attachment this is, which can take one of the following values: - DEDICATED: an attachment to a Dedicated Interconnect. - PARTNER: an attachment to a Partner Interconnect, created by the customer. - PARTNER_PROVIDER: an attachment to a Partner Interconnect, created by the partner.
@@ -614,6 +618,7 @@
   },
   &quot;region&quot;: &quot;A String&quot;, # [Output Only] URL of the region where the regional interconnect attachment resides. You must specify this field as part of the HTTP request URL. It is not settable as a field in the request body.
   &quot;router&quot;: &quot;A String&quot;, # URL of the Cloud Router to be used for dynamic routing. This router must be in the same region as this InterconnectAttachment. The InterconnectAttachment will automatically connect the Interconnect to the network &amp; region within which the Cloud Router is configured.
+  &quot;satisfiesPzs&quot;: True or False, # [Output Only] Set to true if the resource satisfies the zone separation organization policy constraints and false otherwise. Defaults to false if the field is not present.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;state&quot;: &quot;A String&quot;, # [Output Only] The current state of this attachment&#x27;s functionality. Enum values ACTIVE and UNPROVISIONED are shared by DEDICATED/PRIVATE, PARTNER, and PARTNER_PROVIDER interconnect attachments, while enum values PENDING_PARTNER, PARTNER_REQUEST_RECEIVED, and PENDING_CUSTOMER are used for only PARTNER and PARTNER_PROVIDER interconnect attachments. This state can take one of the following values: - ACTIVE: The attachment has been turned up and is ready to use. - UNPROVISIONED: The attachment is not ready to use yet, because turnup is not complete. - PENDING_PARTNER: A newly-created PARTNER attachment that has not yet been configured on the Partner side. - PARTNER_REQUEST_RECEIVED: A PARTNER attachment is in the process of provisioning after a PARTNER_PROVIDER attachment was created that references it. - PENDING_CUSTOMER: A PARTNER or PARTNER_PROVIDER attachment that is waiting for a customer to activate it. - DEFUNCT: The attachment was deleted externally and is no longer functional. This could be because the associated Interconnect was removed, or because the other side of a Partner attachment was deleted.
   &quot;type&quot;: &quot;A String&quot;, # The type of interconnect attachment this is, which can take one of the following values: - DEDICATED: an attachment to a Dedicated Interconnect. - PARTNER: an attachment to a Partner Interconnect, created by the customer. - PARTNER_PROVIDER: an attachment to a Partner Interconnect, created by the partner.
diff --git a/docs/dyn/compute_beta.interconnectLocations.html b/docs/dyn/compute_beta.interconnectLocations.html
index 0175534..8fd7f6f 100644
--- a/docs/dyn/compute_beta.interconnectLocations.html
+++ b/docs/dyn/compute_beta.interconnectLocations.html
@@ -129,6 +129,7 @@
   ],
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;status&quot;: &quot;A String&quot;, # [Output Only] The status of this InterconnectLocation, which can take one of the following values: - CLOSED: The InterconnectLocation is closed and is unavailable for provisioning new Interconnects. - AVAILABLE: The InterconnectLocation is available for provisioning new Interconnects.
+  &quot;supportsPzs&quot;: True or False, # [Output Only] Set to true for locations that support physical zone separation. Defaults to false if the field is not present.
 }</pre>
 </div>
 
@@ -176,6 +177,7 @@
       ],
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
       &quot;status&quot;: &quot;A String&quot;, # [Output Only] The status of this InterconnectLocation, which can take one of the following values: - CLOSED: The InterconnectLocation is closed and is unavailable for provisioning new Interconnects. - AVAILABLE: The InterconnectLocation is available for provisioning new Interconnects.
+      &quot;supportsPzs&quot;: True or False, # [Output Only] Set to true for locations that support physical zone separation. Defaults to false if the field is not present.
     },
   ],
   &quot;kind&quot;: &quot;compute#interconnectLocationList&quot;, # [Output Only] Type of resource. Always compute#interconnectLocationList for lists of interconnect locations.
diff --git a/docs/dyn/compute_beta.interconnects.html b/docs/dyn/compute_beta.interconnects.html
index 3d6b026..3bdbccd 100644
--- a/docs/dyn/compute_beta.interconnects.html
+++ b/docs/dyn/compute_beta.interconnects.html
@@ -234,6 +234,7 @@
   &quot;peerIpAddress&quot;: &quot;A String&quot;, # [Output Only] IP address configured on the customer side of the Interconnect link. The customer should configure this IP address during turnup when prompted by Google NOC. This can be used only for ping tests.
   &quot;provisionedLinkCount&quot;: 42, # [Output Only] Number of links actually provisioned in this interconnect.
   &quot;requestedLinkCount&quot;: 42, # Target number of physical links in the link bundle, as requested by the customer.
+  &quot;satisfiesPzs&quot;: True or False, # [Output Only] Set to true if the resource satisfies the zone separation organization policy constraints and false otherwise. Defaults to false if the field is not present.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;state&quot;: &quot;A String&quot;, # [Output Only] The current state of Interconnect functionality, which can take one of the following values: - ACTIVE: The Interconnect is valid, turned up and ready to use. Attachments may be provisioned on this Interconnect. - UNPROVISIONED: The Interconnect has not completed turnup. No attachments may be provisioned on this Interconnect. - UNDER_MAINTENANCE: The Interconnect is undergoing internal maintenance. No attachments may be provisioned or updated on this Interconnect.
 }</pre>
@@ -347,6 +348,7 @@
   &quot;peerIpAddress&quot;: &quot;A String&quot;, # [Output Only] IP address configured on the customer side of the Interconnect link. The customer should configure this IP address during turnup when prompted by Google NOC. This can be used only for ping tests.
   &quot;provisionedLinkCount&quot;: 42, # [Output Only] Number of links actually provisioned in this interconnect.
   &quot;requestedLinkCount&quot;: 42, # Target number of physical links in the link bundle, as requested by the customer.
+  &quot;satisfiesPzs&quot;: True or False, # [Output Only] Set to true if the resource satisfies the zone separation organization policy constraints and false otherwise. Defaults to false if the field is not present.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;state&quot;: &quot;A String&quot;, # [Output Only] The current state of Interconnect functionality, which can take one of the following values: - ACTIVE: The Interconnect is valid, turned up and ready to use. Attachments may be provisioned on this Interconnect. - UNPROVISIONED: The Interconnect has not completed turnup. No attachments may be provisioned on this Interconnect. - UNDER_MAINTENANCE: The Interconnect is undergoing internal maintenance. No attachments may be provisioned or updated on this Interconnect.
 }
@@ -475,6 +477,7 @@
       &quot;peerIpAddress&quot;: &quot;A String&quot;, # [Output Only] IP address configured on the customer side of the Interconnect link. The customer should configure this IP address during turnup when prompted by Google NOC. This can be used only for ping tests.
       &quot;provisionedLinkCount&quot;: 42, # [Output Only] Number of links actually provisioned in this interconnect.
       &quot;requestedLinkCount&quot;: 42, # Target number of physical links in the link bundle, as requested by the customer.
+      &quot;satisfiesPzs&quot;: True or False, # [Output Only] Set to true if the resource satisfies the zone separation organization policy constraints and false otherwise. Defaults to false if the field is not present.
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
       &quot;state&quot;: &quot;A String&quot;, # [Output Only] The current state of Interconnect functionality, which can take one of the following values: - ACTIVE: The Interconnect is valid, turned up and ready to use. Attachments may be provisioned on this Interconnect. - UNPROVISIONED: The Interconnect has not completed turnup. No attachments may be provisioned on this Interconnect. - UNDER_MAINTENANCE: The Interconnect is undergoing internal maintenance. No attachments may be provisioned or updated on this Interconnect.
     },
@@ -565,6 +568,7 @@
   &quot;peerIpAddress&quot;: &quot;A String&quot;, # [Output Only] IP address configured on the customer side of the Interconnect link. The customer should configure this IP address during turnup when prompted by Google NOC. This can be used only for ping tests.
   &quot;provisionedLinkCount&quot;: 42, # [Output Only] Number of links actually provisioned in this interconnect.
   &quot;requestedLinkCount&quot;: 42, # Target number of physical links in the link bundle, as requested by the customer.
+  &quot;satisfiesPzs&quot;: True or False, # [Output Only] Set to true if the resource satisfies the zone separation organization policy constraints and false otherwise. Defaults to false if the field is not present.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;state&quot;: &quot;A String&quot;, # [Output Only] The current state of Interconnect functionality, which can take one of the following values: - ACTIVE: The Interconnect is valid, turned up and ready to use. Attachments may be provisioned on this Interconnect. - UNPROVISIONED: The Interconnect has not completed turnup. No attachments may be provisioned on this Interconnect. - UNDER_MAINTENANCE: The Interconnect is undergoing internal maintenance. No attachments may be provisioned or updated on this Interconnect.
 }
diff --git a/docs/dyn/compute_beta.machineImages.html b/docs/dyn/compute_beta.machineImages.html
index 859734f..92de184 100644
--- a/docs/dyn/compute_beta.machineImages.html
+++ b/docs/dyn/compute_beta.machineImages.html
@@ -192,10 +192,10 @@
   &quot;id&quot;: &quot;A String&quot;, # [Output Only] A unique identifier for this machine image. The server defines this identifier.
   &quot;kind&quot;: &quot;compute#machineImage&quot;, # [Output Only] The resource type, which is always compute#machineImage for machine image.
   &quot;machineImageEncryptionKey&quot;: { # Encrypts the machine image using a customer-supplied encryption key. After you encrypt a machine image using a customer-supplied key, you must provide the same key if you use the machine image later. For example, you must provide the encryption key when you create an instance from the encrypted machine image in a future request. Customer-supplied encryption keys do not protect access to metadata of the machine image. If you do not provide an encryption key when creating the machine image, then the machine image will be encrypted using an automatically generated key and you do not need to provide a key to use the machine image later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
@@ -204,10 +204,10 @@
   &quot;sourceDiskEncryptionKeys&quot;: [ # [Input Only] The customer-supplied encryption key of the disks attached to the source instance. Required if the source disk is protected by a customer-supplied encryption key.
     {
       &quot;diskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceDisk&quot;: &quot;A String&quot;, # URL of the disk attached to the source instance. This can be a full or valid partial URL. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /disks/disk - projects/project/zones/zone/disks/disk - zones/zone/disks/disk
@@ -224,10 +224,10 @@
         &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
         &quot;deviceName&quot;: &quot;A String&quot;, # Specifies the name of the disk attached to the source instance.
         &quot;diskEncryptionKey&quot;: { # The encryption key for the disk.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in base-2 GB.
@@ -483,10 +483,10 @@
   &quot;id&quot;: &quot;A String&quot;, # [Output Only] A unique identifier for this machine image. The server defines this identifier.
   &quot;kind&quot;: &quot;compute#machineImage&quot;, # [Output Only] The resource type, which is always compute#machineImage for machine image.
   &quot;machineImageEncryptionKey&quot;: { # Encrypts the machine image using a customer-supplied encryption key. After you encrypt a machine image using a customer-supplied key, you must provide the same key if you use the machine image later. For example, you must provide the encryption key when you create an instance from the encrypted machine image in a future request. Customer-supplied encryption keys do not protect access to metadata of the machine image. If you do not provide an encryption key when creating the machine image, then the machine image will be encrypted using an automatically generated key and you do not need to provide a key to use the machine image later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
@@ -495,10 +495,10 @@
   &quot;sourceDiskEncryptionKeys&quot;: [ # [Input Only] The customer-supplied encryption key of the disks attached to the source instance. Required if the source disk is protected by a customer-supplied encryption key.
     {
       &quot;diskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceDisk&quot;: &quot;A String&quot;, # URL of the disk attached to the source instance. This can be a full or valid partial URL. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /disks/disk - projects/project/zones/zone/disks/disk - zones/zone/disks/disk
@@ -515,10 +515,10 @@
         &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
         &quot;deviceName&quot;: &quot;A String&quot;, # Specifies the name of the disk attached to the source instance.
         &quot;diskEncryptionKey&quot;: { # The encryption key for the disk.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in base-2 GB.
@@ -739,10 +739,10 @@
       &quot;id&quot;: &quot;A String&quot;, # [Output Only] A unique identifier for this machine image. The server defines this identifier.
       &quot;kind&quot;: &quot;compute#machineImage&quot;, # [Output Only] The resource type, which is always compute#machineImage for machine image.
       &quot;machineImageEncryptionKey&quot;: { # Encrypts the machine image using a customer-supplied encryption key. After you encrypt a machine image using a customer-supplied key, you must provide the same key if you use the machine image later. For example, you must provide the encryption key when you create an instance from the encrypted machine image in a future request. Customer-supplied encryption keys do not protect access to metadata of the machine image. If you do not provide an encryption key when creating the machine image, then the machine image will be encrypted using an automatically generated key and you do not need to provide a key to use the machine image later.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
@@ -751,10 +751,10 @@
       &quot;sourceDiskEncryptionKeys&quot;: [ # [Input Only] The customer-supplied encryption key of the disks attached to the source instance. Required if the source disk is protected by a customer-supplied encryption key.
         {
           &quot;diskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;sourceDisk&quot;: &quot;A String&quot;, # URL of the disk attached to the source instance. This can be a full or valid partial URL. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /disks/disk - projects/project/zones/zone/disks/disk - zones/zone/disks/disk
@@ -771,10 +771,10 @@
             &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
             &quot;deviceName&quot;: &quot;A String&quot;, # Specifies the name of the disk attached to the source instance.
             &quot;diskEncryptionKey&quot;: { # The encryption key for the disk.
-              &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-              &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-              &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-              &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+              &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+              &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+              &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+              &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
               &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
             },
             &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in base-2 GB.
diff --git a/docs/dyn/compute_beta.networks.html b/docs/dyn/compute_beta.networks.html
index 2d61a7c..456f71e 100644
--- a/docs/dyn/compute_beta.networks.html
+++ b/docs/dyn/compute_beta.networks.html
@@ -413,7 +413,7 @@
         &quot;enable&quot;: True or False, # This field denotes whether to enable logging for a particular firewall rule.
         &quot;metadata&quot;: &quot;A String&quot;, # This field can only be specified for a particular firewall rule if logging is enabled for that rule. This field denotes whether to include or exclude metadata for firewall logs.
       },
-      &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+      &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
       &quot;network&quot;: &quot;A String&quot;, # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
       &quot;priority&quot;: 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
diff --git a/docs/dyn/compute_beta.regionBackendServices.html b/docs/dyn/compute_beta.regionBackendServices.html
index f1c6203..00ee4bb 100644
--- a/docs/dyn/compute_beta.regionBackendServices.html
+++ b/docs/dyn/compute_beta.regionBackendServices.html
@@ -272,8 +272,8 @@
   },
   &quot;connectionTrackingPolicy&quot;: { # Connection Tracking configuration for this BackendService.
     &quot;connectionPersistenceOnUnhealthyBackends&quot;: &quot;A String&quot;, # Specifies connection persistence when backends are unhealthy. The default value is DEFAULT_FOR_PROTOCOL. If set to DEFAULT_FOR_PROTOCOL, the existing connections persist on unhealthy backends only for connection-oriented protocols (TCP and SCTP) and only if the Tracking Mode is PER_CONNECTION (default tracking mode) or the Session Affinity is configured for 5-tuple. They do not persist for UDP. If set to NEVER_PERSIST, after a backend becomes unhealthy, the existing connections on the unhealthy backend are never persisted on the unhealthy backend. They are always diverted to newly selected healthy backends (unless all backends are unhealthy). If set to ALWAYS_PERSIST, existing connections always persist on unhealthy backends regardless of protocol and session affinity. It is generally not recommended to use this mode overriding the default.
-    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity. This is only available in External TCP/UDP load balancer.
-    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For NLB the minimum(default) is 60 seconds and the maximum is 16 hours. This field will be supported only if the Connection Tracking key is less than 5-tuple.
+    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity for Network Load Balancing. This option is not available publicly.
+    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For Network Load Balancer the default is 60 seconds. This option is not available publicly. This field will be supported only if the Connection Tracking key is less than 5-tuple.
     &quot;trackingMode&quot;: &quot;A String&quot;, # Specifies the key used for connection tracking. There are two options: PER_CONNECTION: This is the default mode. The Connection Tracking is performed as per the Connection Key (default Hash Method) for the specific protocol. PER_SESSION: The Connection Tracking is performed as per the configured Session Affinity. It matches the configured Session Affinity.
   },
   &quot;consistentHash&quot;: { # This message defines settings for a consistent hash style load balancer. # Consistent Hash-based load balancing can be used to provide soft session affinity based on HTTP headers, cookies or other properties. This load balancing policy is applicable only for HTTP connections. The affinity to a particular destination host will be lost when one or more hosts are added/removed from the destination service. This field specifies parameters that control consistent hashing. This field is only applicable when localityLbPolicy is set to MAGLEV or RING_HASH. This field is applicable to either: - A regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2, and load_balancing_scheme set to INTERNAL_MANAGED. - A global backend service with the load_balancing_scheme set to INTERNAL_SELF_MANAGED. Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
@@ -604,8 +604,8 @@
   },
   &quot;connectionTrackingPolicy&quot;: { # Connection Tracking configuration for this BackendService.
     &quot;connectionPersistenceOnUnhealthyBackends&quot;: &quot;A String&quot;, # Specifies connection persistence when backends are unhealthy. The default value is DEFAULT_FOR_PROTOCOL. If set to DEFAULT_FOR_PROTOCOL, the existing connections persist on unhealthy backends only for connection-oriented protocols (TCP and SCTP) and only if the Tracking Mode is PER_CONNECTION (default tracking mode) or the Session Affinity is configured for 5-tuple. They do not persist for UDP. If set to NEVER_PERSIST, after a backend becomes unhealthy, the existing connections on the unhealthy backend are never persisted on the unhealthy backend. They are always diverted to newly selected healthy backends (unless all backends are unhealthy). If set to ALWAYS_PERSIST, existing connections always persist on unhealthy backends regardless of protocol and session affinity. It is generally not recommended to use this mode overriding the default.
-    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity. This is only available in External TCP/UDP load balancer.
-    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For NLB the minimum(default) is 60 seconds and the maximum is 16 hours. This field will be supported only if the Connection Tracking key is less than 5-tuple.
+    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity for Network Load Balancing. This option is not available publicly.
+    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For Network Load Balancer the default is 60 seconds. This option is not available publicly. This field will be supported only if the Connection Tracking key is less than 5-tuple.
     &quot;trackingMode&quot;: &quot;A String&quot;, # Specifies the key used for connection tracking. There are two options: PER_CONNECTION: This is the default mode. The Connection Tracking is performed as per the Connection Key (default Hash Method) for the specific protocol. PER_SESSION: The Connection Tracking is performed as per the configured Session Affinity. It matches the configured Session Affinity.
   },
   &quot;consistentHash&quot;: { # This message defines settings for a consistent hash style load balancer. # Consistent Hash-based load balancing can be used to provide soft session affinity based on HTTP headers, cookies or other properties. This load balancing policy is applicable only for HTTP connections. The affinity to a particular destination host will be lost when one or more hosts are added/removed from the destination service. This field specifies parameters that control consistent hashing. This field is only applicable when localityLbPolicy is set to MAGLEV or RING_HASH. This field is applicable to either: - A regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2, and load_balancing_scheme set to INTERNAL_MANAGED. - A global backend service with the load_balancing_scheme set to INTERNAL_SELF_MANAGED. Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
@@ -853,8 +853,8 @@
       },
       &quot;connectionTrackingPolicy&quot;: { # Connection Tracking configuration for this BackendService.
         &quot;connectionPersistenceOnUnhealthyBackends&quot;: &quot;A String&quot;, # Specifies connection persistence when backends are unhealthy. The default value is DEFAULT_FOR_PROTOCOL. If set to DEFAULT_FOR_PROTOCOL, the existing connections persist on unhealthy backends only for connection-oriented protocols (TCP and SCTP) and only if the Tracking Mode is PER_CONNECTION (default tracking mode) or the Session Affinity is configured for 5-tuple. They do not persist for UDP. If set to NEVER_PERSIST, after a backend becomes unhealthy, the existing connections on the unhealthy backend are never persisted on the unhealthy backend. They are always diverted to newly selected healthy backends (unless all backends are unhealthy). If set to ALWAYS_PERSIST, existing connections always persist on unhealthy backends regardless of protocol and session affinity. It is generally not recommended to use this mode overriding the default.
-        &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity. This is only available in External TCP/UDP load balancer.
-        &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For NLB the minimum(default) is 60 seconds and the maximum is 16 hours. This field will be supported only if the Connection Tracking key is less than 5-tuple.
+        &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity for Network Load Balancing. This option is not available publicly.
+        &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For Network Load Balancer the default is 60 seconds. This option is not available publicly. This field will be supported only if the Connection Tracking key is less than 5-tuple.
         &quot;trackingMode&quot;: &quot;A String&quot;, # Specifies the key used for connection tracking. There are two options: PER_CONNECTION: This is the default mode. The Connection Tracking is performed as per the Connection Key (default Hash Method) for the specific protocol. PER_SESSION: The Connection Tracking is performed as per the configured Session Affinity. It matches the configured Session Affinity.
       },
       &quot;consistentHash&quot;: { # This message defines settings for a consistent hash style load balancer. # Consistent Hash-based load balancing can be used to provide soft session affinity based on HTTP headers, cookies or other properties. This load balancing policy is applicable only for HTTP connections. The affinity to a particular destination host will be lost when one or more hosts are added/removed from the destination service. This field specifies parameters that control consistent hashing. This field is only applicable when localityLbPolicy is set to MAGLEV or RING_HASH. This field is applicable to either: - A regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2, and load_balancing_scheme set to INTERNAL_MANAGED. - A global backend service with the load_balancing_scheme set to INTERNAL_SELF_MANAGED. Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
@@ -1064,8 +1064,8 @@
   },
   &quot;connectionTrackingPolicy&quot;: { # Connection Tracking configuration for this BackendService.
     &quot;connectionPersistenceOnUnhealthyBackends&quot;: &quot;A String&quot;, # Specifies connection persistence when backends are unhealthy. The default value is DEFAULT_FOR_PROTOCOL. If set to DEFAULT_FOR_PROTOCOL, the existing connections persist on unhealthy backends only for connection-oriented protocols (TCP and SCTP) and only if the Tracking Mode is PER_CONNECTION (default tracking mode) or the Session Affinity is configured for 5-tuple. They do not persist for UDP. If set to NEVER_PERSIST, after a backend becomes unhealthy, the existing connections on the unhealthy backend are never persisted on the unhealthy backend. They are always diverted to newly selected healthy backends (unless all backends are unhealthy). If set to ALWAYS_PERSIST, existing connections always persist on unhealthy backends regardless of protocol and session affinity. It is generally not recommended to use this mode overriding the default.
-    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity. This is only available in External TCP/UDP load balancer.
-    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For NLB the minimum(default) is 60 seconds and the maximum is 16 hours. This field will be supported only if the Connection Tracking key is less than 5-tuple.
+    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity for Network Load Balancing. This option is not available publicly.
+    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For Network Load Balancer the default is 60 seconds. This option is not available publicly. This field will be supported only if the Connection Tracking key is less than 5-tuple.
     &quot;trackingMode&quot;: &quot;A String&quot;, # Specifies the key used for connection tracking. There are two options: PER_CONNECTION: This is the default mode. The Connection Tracking is performed as per the Connection Key (default Hash Method) for the specific protocol. PER_SESSION: The Connection Tracking is performed as per the configured Session Affinity. It matches the configured Session Affinity.
   },
   &quot;consistentHash&quot;: { # This message defines settings for a consistent hash style load balancer. # Consistent Hash-based load balancing can be used to provide soft session affinity based on HTTP headers, cookies or other properties. This load balancing policy is applicable only for HTTP connections. The affinity to a particular destination host will be lost when one or more hosts are added/removed from the destination service. This field specifies parameters that control consistent hashing. This field is only applicable when localityLbPolicy is set to MAGLEV or RING_HASH. This field is applicable to either: - A regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2, and load_balancing_scheme set to INTERNAL_MANAGED. - A global backend service with the load_balancing_scheme set to INTERNAL_SELF_MANAGED. Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
@@ -1545,8 +1545,8 @@
   },
   &quot;connectionTrackingPolicy&quot;: { # Connection Tracking configuration for this BackendService.
     &quot;connectionPersistenceOnUnhealthyBackends&quot;: &quot;A String&quot;, # Specifies connection persistence when backends are unhealthy. The default value is DEFAULT_FOR_PROTOCOL. If set to DEFAULT_FOR_PROTOCOL, the existing connections persist on unhealthy backends only for connection-oriented protocols (TCP and SCTP) and only if the Tracking Mode is PER_CONNECTION (default tracking mode) or the Session Affinity is configured for 5-tuple. They do not persist for UDP. If set to NEVER_PERSIST, after a backend becomes unhealthy, the existing connections on the unhealthy backend are never persisted on the unhealthy backend. They are always diverted to newly selected healthy backends (unless all backends are unhealthy). If set to ALWAYS_PERSIST, existing connections always persist on unhealthy backends regardless of protocol and session affinity. It is generally not recommended to use this mode overriding the default.
-    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity. This is only available in External TCP/UDP load balancer.
-    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For NLB the minimum(default) is 60 seconds and the maximum is 16 hours. This field will be supported only if the Connection Tracking key is less than 5-tuple.
+    &quot;enableStrongAffinity&quot;: True or False, # Enable Strong Session Affinity for Network Load Balancing. This option is not available publicly.
+    &quot;idleTimeoutSec&quot;: 42, # Specifies how long to keep a Connection Tracking entry while there is no matching traffic (in seconds). For L4 ILB the minimum(default) is 10 minutes and maximum is 16 hours. For Network Load Balancer the default is 60 seconds. This option is not available publicly. This field will be supported only if the Connection Tracking key is less than 5-tuple.
     &quot;trackingMode&quot;: &quot;A String&quot;, # Specifies the key used for connection tracking. There are two options: PER_CONNECTION: This is the default mode. The Connection Tracking is performed as per the Connection Key (default Hash Method) for the specific protocol. PER_SESSION: The Connection Tracking is performed as per the configured Session Affinity. It matches the configured Session Affinity.
   },
   &quot;consistentHash&quot;: { # This message defines settings for a consistent hash style load balancer. # Consistent Hash-based load balancing can be used to provide soft session affinity based on HTTP headers, cookies or other properties. This load balancing policy is applicable only for HTTP connections. The affinity to a particular destination host will be lost when one or more hosts are added/removed from the destination service. This field specifies parameters that control consistent hashing. This field is only applicable when localityLbPolicy is set to MAGLEV or RING_HASH. This field is applicable to either: - A regional backend service with the service_protocol set to HTTP, HTTPS, or HTTP2, and load_balancing_scheme set to INTERNAL_MANAGED. - A global backend service with the load_balancing_scheme set to INTERNAL_SELF_MANAGED. Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
diff --git a/docs/dyn/compute_beta.regionDisks.html b/docs/dyn/compute_beta.regionDisks.html
index 305cf55..14507af 100644
--- a/docs/dyn/compute_beta.regionDisks.html
+++ b/docs/dyn/compute_beta.regionDisks.html
@@ -234,18 +234,18 @@
   &quot;satisfiesPzs&quot;: True or False, # [Output Only] Reserved for future use.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;snapshotEncryptionKey&quot;: { # Encrypts the snapshot using a customer-supplied encryption key. After you encrypt a snapshot using a customer-supplied key, you must provide the same key if you use the snapshot later. For example, you must provide the encryption key when you create a disk from the encrypted snapshot in a future request. Customer-supplied encryption keys do not protect access to metadata of the snapshot. If you do not provide an encryption key when creating the snapshot, then the snapshot will be encrypted using an automatically generated key and you do not need to provide a key to use the snapshot later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDisk&quot;: &quot;A String&quot;, # The source disk used to create this snapshot.
   &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this snapshot. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given disk name.
@@ -400,10 +400,10 @@
   &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
   &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
   &quot;diskEncryptionKey&quot;: { # Encrypts the disk using a customer-supplied encryption key or a customer-managed encryption key. Encryption keys do not protect access to metadata of the disk. After you encrypt a disk with a customer-supplied key, you must provide the same key if you use the disk later. For example, to create a disk snapshot, to create a disk image, to create a machine image, or to attach the disk to a virtual machine. After you encrypt a disk with a customer-managed key, the diskEncryptionKey.kmsKeyName is set to a key *version* name once the disk is created. The disk is encrypted with this version of the key. In the response, diskEncryptionKey.kmsKeyName appears in the following format: &quot;diskEncryptionKey.kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key /cryptoKeysVersions/version If you do not provide an encryption key when creating the disk, then the disk is encrypted using an automatically generated key and you don&#x27;t need to provide a key to use the disk later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;eraseWindowsVssSignature&quot;: True or False, # Specifies whether the disk restored from a source snapshot should erase Windows specific VSS signature.
@@ -448,19 +448,19 @@
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the disk used to create this disk. This value identifies the exact disk that was used to create this persistent disk. For example, if you created the persistent disk from a disk that was later deleted and recreated under the same name, the source disk ID would identify the exact version of the disk that was used.
   &quot;sourceImage&quot;: &quot;A String&quot;, # The source image used to create this disk. If the source image is deleted, this field will not be set. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family
   &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
   &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/snapshots/snapshot - projects/project/global/snapshots/snapshot - global/snapshots/snapshot
   &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.
@@ -597,10 +597,10 @@
   &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
   &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
   &quot;diskEncryptionKey&quot;: { # Encrypts the disk using a customer-supplied encryption key or a customer-managed encryption key. Encryption keys do not protect access to metadata of the disk. After you encrypt a disk with a customer-supplied key, you must provide the same key if you use the disk later. For example, to create a disk snapshot, to create a disk image, to create a machine image, or to attach the disk to a virtual machine. After you encrypt a disk with a customer-managed key, the diskEncryptionKey.kmsKeyName is set to a key *version* name once the disk is created. The disk is encrypted with this version of the key. In the response, diskEncryptionKey.kmsKeyName appears in the following format: &quot;diskEncryptionKey.kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key /cryptoKeysVersions/version If you do not provide an encryption key when creating the disk, then the disk is encrypted using an automatically generated key and you don&#x27;t need to provide a key to use the disk later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;eraseWindowsVssSignature&quot;: True or False, # Specifies whether the disk restored from a source snapshot should erase Windows specific VSS signature.
@@ -645,19 +645,19 @@
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the disk used to create this disk. This value identifies the exact disk that was used to create this persistent disk. For example, if you created the persistent disk from a disk that was later deleted and recreated under the same name, the source disk ID would identify the exact version of the disk that was used.
   &quot;sourceImage&quot;: &quot;A String&quot;, # The source image used to create this disk. If the source image is deleted, this field will not be set. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family
   &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
   &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/snapshots/snapshot - projects/project/global/snapshots/snapshot - global/snapshots/snapshot
   &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.
@@ -758,10 +758,10 @@
       &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
       &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
       &quot;diskEncryptionKey&quot;: { # Encrypts the disk using a customer-supplied encryption key or a customer-managed encryption key. Encryption keys do not protect access to metadata of the disk. After you encrypt a disk with a customer-supplied key, you must provide the same key if you use the disk later. For example, to create a disk snapshot, to create a disk image, to create a machine image, or to attach the disk to a virtual machine. After you encrypt a disk with a customer-managed key, the diskEncryptionKey.kmsKeyName is set to a key *version* name once the disk is created. The disk is encrypted with this version of the key. In the response, diskEncryptionKey.kmsKeyName appears in the following format: &quot;diskEncryptionKey.kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key /cryptoKeysVersions/version If you do not provide an encryption key when creating the disk, then the disk is encrypted using an automatically generated key and you don&#x27;t need to provide a key to use the disk later.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;eraseWindowsVssSignature&quot;: True or False, # Specifies whether the disk restored from a source snapshot should erase Windows specific VSS signature.
@@ -806,19 +806,19 @@
       &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the disk used to create this disk. This value identifies the exact disk that was used to create this persistent disk. For example, if you created the persistent disk from a disk that was later deleted and recreated under the same name, the source disk ID would identify the exact version of the disk that was used.
       &quot;sourceImage&quot;: &quot;A String&quot;, # The source image used to create this disk. If the source image is deleted, this field will not be set. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family
       &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
       &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/snapshots/snapshot - projects/project/global/snapshots/snapshot - global/snapshots/snapshot
       &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.
@@ -1342,10 +1342,10 @@
   &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
   &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
   &quot;diskEncryptionKey&quot;: { # Encrypts the disk using a customer-supplied encryption key or a customer-managed encryption key. Encryption keys do not protect access to metadata of the disk. After you encrypt a disk with a customer-supplied key, you must provide the same key if you use the disk later. For example, to create a disk snapshot, to create a disk image, to create a machine image, or to attach the disk to a virtual machine. After you encrypt a disk with a customer-managed key, the diskEncryptionKey.kmsKeyName is set to a key *version* name once the disk is created. The disk is encrypted with this version of the key. In the response, diskEncryptionKey.kmsKeyName appears in the following format: &quot;diskEncryptionKey.kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key /cryptoKeysVersions/version If you do not provide an encryption key when creating the disk, then the disk is encrypted using an automatically generated key and you don&#x27;t need to provide a key to use the disk later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;eraseWindowsVssSignature&quot;: True or False, # Specifies whether the disk restored from a source snapshot should erase Windows specific VSS signature.
@@ -1390,19 +1390,19 @@
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the disk used to create this disk. This value identifies the exact disk that was used to create this persistent disk. For example, if you created the persistent disk from a disk that was later deleted and recreated under the same name, the source disk ID would identify the exact version of the disk that was used.
   &quot;sourceImage&quot;: &quot;A String&quot;, # The source image used to create this disk. If the source image is deleted, this field will not be set. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family
   &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
   &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/snapshots/snapshot - projects/project/global/snapshots/snapshot - global/snapshots/snapshot
   &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.
diff --git a/docs/dyn/compute_beta.regionInstanceGroupManagers.html b/docs/dyn/compute_beta.regionInstanceGroupManagers.html
index c9c9e57..6b6a77d 100644
--- a/docs/dyn/compute_beta.regionInstanceGroupManagers.html
+++ b/docs/dyn/compute_beta.regionInstanceGroupManagers.html
@@ -127,7 +127,7 @@
 <p class="firstline">Retrieves the next page of results.</p>
 <p class="toc_element">
   <code><a href="#patch">patch(project, region, instanceGroupManager, body=None, requestId=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is patched even if the instances in the group are still in the process of being patched. You must separately verify the status of the individual instances with the listmanagedinstances method. This method supports PATCH semantics and uses the JSON merge patch format and processing rules.</p>
+<p class="firstline">Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is patched even if the instances in the group are still in the process of being patched. You must separately verify the status of the individual instances with the listmanagedinstances method. This method supports PATCH semantics and uses the JSON merge patch format and processing rules. If you update your group to specify a new template or instance configuration, it's possible that your intended specification for each VM in the group is different from the current state of that VM. To learn how to apply an updated configuration to the VMs in a MIG, see Updating instances in a MIG.</p>
 <p class="toc_element">
   <code><a href="#patchPerInstanceConfigs">patchPerInstanceConfigs(project, region, instanceGroupManager, body=None, requestId=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Inserts or patches per-instance configs for the managed instance group. perInstanceConfig.name serves as a key used to distinguish whether to perform insert or patch.</p>
@@ -151,7 +151,7 @@
 <p class="firstline">Returns permissions that a caller has on the specified resource.</p>
 <p class="toc_element">
   <code><a href="#update">update(project, region, instanceGroupManager, body=None, requestId=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is updated even if the instances in the group have not yet been updated. You must separately verify the status of the individual instances with the listmanagedinstances method.</p>
+<p class="firstline">Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is updated even if the instances in the group have not yet been updated. You must separately verify the status of the individual instances with the listmanagedinstances method. If you update your group to specify a new template or instance configuration, it's possible that your intended specification for each VM in the group is different from the current state of that VM. To learn how to apply an updated configuration to the VMs in a MIG, see Updating instances in a MIG.</p>
 <p class="toc_element">
   <code><a href="#updatePerInstanceConfigs">updatePerInstanceConfigs(project, region, instanceGroupManager, body=None, requestId=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Inserts or updates per-instance configs for the managed instance group. perInstanceConfig.name serves as a key used to distinguish whether to perform insert or patch.</p>
@@ -1277,7 +1277,7 @@
 
 <div class="method">
     <code class="details" id="patch">patch(project, region, instanceGroupManager, body=None, requestId=None, x__xgafv=None)</code>
-  <pre>Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is patched even if the instances in the group are still in the process of being patched. You must separately verify the status of the individual instances with the listmanagedinstances method. This method supports PATCH semantics and uses the JSON merge patch format and processing rules.
+  <pre>Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is patched even if the instances in the group are still in the process of being patched. You must separately verify the status of the individual instances with the listmanagedinstances method. This method supports PATCH semantics and uses the JSON merge patch format and processing rules. If you update your group to specify a new template or instance configuration, it&#x27;s possible that your intended specification for each VM in the group is different from the current state of that VM. To learn how to apply an updated configuration to the VMs in a MIG, see Updating instances in a MIG.
 
 Args:
   project: string, Project ID for this request. (required)
@@ -1928,7 +1928,7 @@
 
 <div class="method">
     <code class="details" id="update">update(project, region, instanceGroupManager, body=None, requestId=None, x__xgafv=None)</code>
-  <pre>Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is updated even if the instances in the group have not yet been updated. You must separately verify the status of the individual instances with the listmanagedinstances method.
+  <pre>Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is updated even if the instances in the group have not yet been updated. You must separately verify the status of the individual instances with the listmanagedinstances method. If you update your group to specify a new template or instance configuration, it&#x27;s possible that your intended specification for each VM in the group is different from the current state of that VM. To learn how to apply an updated configuration to the VMs in a MIG, see Updating instances in a MIG.
 
 Args:
   project: string, Project ID for this request. (required)
diff --git a/docs/dyn/compute_beta.regionInstances.html b/docs/dyn/compute_beta.regionInstances.html
index edef7f4..de7eafe 100644
--- a/docs/dyn/compute_beta.regionInstances.html
+++ b/docs/dyn/compute_beta.regionInstances.html
@@ -109,10 +109,10 @@
         &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
         &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
         &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -143,18 +143,18 @@
           ],
           &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
           &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
           &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
         },
@@ -270,7 +270,7 @@
     &quot;networkPerformanceConfig&quot;: {
       &quot;totalEgressBandwidthTier&quot;: &quot;A String&quot;,
     },
-    &quot;postKeyRevocationActionType&quot;: &quot;A String&quot;, # PostKeyRevocationActionType of the instance.
+    &quot;postKeyRevocationActionType&quot;: &quot;A String&quot;, # PostKeyRevocationActionType of the instance.(will be deprecated soon)
     &quot;privateIpv6GoogleAccess&quot;: &quot;A String&quot;, # The private IPv6 google access type for VMs. If not specified, use INHERIT_FROM_SUBNETWORK as default.
     &quot;reservationAffinity&quot;: { # Specifies the reservations that this instance can consume from. # Specifies the reservations that instances can consume from.
       &quot;consumeReservationType&quot;: &quot;A String&quot;, # Specifies the type of reservation from which this instance can consume resources: ANY_RESERVATION (default), SPECIFIC_RESERVATION, or NO_RESERVATION. See Consuming reserved instances for examples.
diff --git a/docs/dyn/compute_beta.routers.html b/docs/dyn/compute_beta.routers.html
index 0a7839a..d13f4ff 100644
--- a/docs/dyn/compute_beta.routers.html
+++ b/docs/dyn/compute_beta.routers.html
@@ -224,6 +224,21 @@
               &quot;natIps&quot;: [ # A list of URLs of the IP resources used for this Nat service. These IP addresses must be valid static external IP addresses assigned to the project.
                 &quot;A String&quot;,
               ],
+              &quot;rules&quot;: [ # A list of rules associated with this NAT.
+                {
+                  &quot;action&quot;: { # The action to be enforced for traffic that matches this rule.
+                    &quot;sourceNatActiveIps&quot;: [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project. This field is used for public NAT.
+                      &quot;A String&quot;,
+                    ],
+                    &quot;sourceNatDrainIps&quot;: [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only. This field is used for public NAT.
+                      &quot;A String&quot;,
+                    ],
+                  },
+                  &quot;description&quot;: &quot;A String&quot;, # An optional description of this rule.
+                  &quot;match&quot;: &quot;A String&quot;, # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions for public NAT: &quot;inIpRange(destination.ip, &#x27;1.1.0.0/16&#x27;) || inIpRange(destination.ip, &#x27;2.2.0.0/16&#x27;)&quot; &quot;destination.ip == &#x27;1.1.0.1&#x27; || destination.ip == &#x27;8.8.8.8&#x27;&quot; The following example is a valid match expression for private NAT: &quot;nexthop.hub == &#x27;/projects/my-project/global/hub/hub-1&#x27;&quot;
+                  &quot;ruleNumber&quot;: 42, # An integer uniquely identifying a rule in the list. The rule number must be a positive value between 0 and 65000, and must be unique among rules within a NAT.
+                },
+              ],
               &quot;sourceSubnetworkIpRangesToNat&quot;: &quot;A String&quot;, # Specify the Nat option, which can take one of the following values: - ALL_SUBNETWORKS_ALL_IP_RANGES: All of the IP ranges in every Subnetwork are allowed to Nat. - ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES: All of the primary IP ranges in every Subnetwork are allowed to Nat. - LIST_OF_SUBNETWORKS: A list of Subnetworks are allowed to Nat (specified in the field subnetwork below) The default is SUBNETWORK_IP_RANGE_TO_NAT_OPTION_UNSPECIFIED. Note that if this field contains ALL_SUBNETWORKS_ALL_IP_RANGES or ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, then there should not be any other Router.Nat section in any Router for this network in this region.
               &quot;subnetworks&quot;: [ # A list of Subnetwork resources whose traffic should be translated by NAT Gateway. It is used only when LIST_OF_SUBNETWORKS is selected for the SubnetworkIpRangeToNatOption above.
                 { # Defines the IP ranges that want to use NAT for a subnetwork.
@@ -237,6 +252,7 @@
                 },
               ],
               &quot;tcpEstablishedIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP established connections. Defaults to 1200s if not set.
+              &quot;tcpTimeWaitTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP connections that are in TIME_WAIT state. Defaults to 120s if not set.
               &quot;tcpTransitoryIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP transitory connections. Defaults to 30s if not set.
               &quot;udpIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for UDP connections. Defaults to 30s if not set.
             },
@@ -455,6 +471,21 @@
       &quot;natIps&quot;: [ # A list of URLs of the IP resources used for this Nat service. These IP addresses must be valid static external IP addresses assigned to the project.
         &quot;A String&quot;,
       ],
+      &quot;rules&quot;: [ # A list of rules associated with this NAT.
+        {
+          &quot;action&quot;: { # The action to be enforced for traffic that matches this rule.
+            &quot;sourceNatActiveIps&quot;: [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project. This field is used for public NAT.
+              &quot;A String&quot;,
+            ],
+            &quot;sourceNatDrainIps&quot;: [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only. This field is used for public NAT.
+              &quot;A String&quot;,
+            ],
+          },
+          &quot;description&quot;: &quot;A String&quot;, # An optional description of this rule.
+          &quot;match&quot;: &quot;A String&quot;, # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions for public NAT: &quot;inIpRange(destination.ip, &#x27;1.1.0.0/16&#x27;) || inIpRange(destination.ip, &#x27;2.2.0.0/16&#x27;)&quot; &quot;destination.ip == &#x27;1.1.0.1&#x27; || destination.ip == &#x27;8.8.8.8&#x27;&quot; The following example is a valid match expression for private NAT: &quot;nexthop.hub == &#x27;/projects/my-project/global/hub/hub-1&#x27;&quot;
+          &quot;ruleNumber&quot;: 42, # An integer uniquely identifying a rule in the list. The rule number must be a positive value between 0 and 65000, and must be unique among rules within a NAT.
+        },
+      ],
       &quot;sourceSubnetworkIpRangesToNat&quot;: &quot;A String&quot;, # Specify the Nat option, which can take one of the following values: - ALL_SUBNETWORKS_ALL_IP_RANGES: All of the IP ranges in every Subnetwork are allowed to Nat. - ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES: All of the primary IP ranges in every Subnetwork are allowed to Nat. - LIST_OF_SUBNETWORKS: A list of Subnetworks are allowed to Nat (specified in the field subnetwork below) The default is SUBNETWORK_IP_RANGE_TO_NAT_OPTION_UNSPECIFIED. Note that if this field contains ALL_SUBNETWORKS_ALL_IP_RANGES or ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, then there should not be any other Router.Nat section in any Router for this network in this region.
       &quot;subnetworks&quot;: [ # A list of Subnetwork resources whose traffic should be translated by NAT Gateway. It is used only when LIST_OF_SUBNETWORKS is selected for the SubnetworkIpRangeToNatOption above.
         { # Defines the IP ranges that want to use NAT for a subnetwork.
@@ -468,6 +499,7 @@
         },
       ],
       &quot;tcpEstablishedIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP established connections. Defaults to 1200s if not set.
+      &quot;tcpTimeWaitTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP connections that are in TIME_WAIT state. Defaults to 120s if not set.
       &quot;tcpTransitoryIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP transitory connections. Defaults to 30s if not set.
       &quot;udpIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for UDP connections. Defaults to 30s if not set.
     },
@@ -572,6 +604,14 @@
   &quot;result&quot;: {
     &quot;bestRoutes&quot;: [ # Best routes for this router&#x27;s network.
       { # Represents a Route resource. A route defines a path from VM instances in the VPC network to a specific destination. This destination can be inside or outside the VPC network. For more information, read the Routes overview.
+        &quot;asPaths&quot;: [ # [Output Only] AS path.
+          {
+            &quot;asLists&quot;: [ # [Output Only] The AS numbers of the AS Path.
+              42,
+            ],
+            &quot;pathSegmentType&quot;: &quot;A String&quot;, # [Output Only] The type of the AS Path, which can be one of the following values: - &#x27;AS_SET&#x27;: unordered set of autonomous systems that the route in has traversed - &#x27;AS_SEQUENCE&#x27;: ordered set of autonomous systems that the route has traversed - &#x27;AS_CONFED_SEQUENCE&#x27;: ordered set of Member Autonomous Systems in the local confederation that the route has traversed - &#x27;AS_CONFED_SET&#x27;: unordered set of Member Autonomous Systems in the local confederation that the route has traversed
+          },
+        ],
         &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
         &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this field when you create the resource.
         &quot;destRange&quot;: &quot;A String&quot;, # The destination range of outgoing packets that this route applies to. Both IPv4 and IPv6 are supported.
@@ -588,6 +628,7 @@
         &quot;nextHopPeering&quot;: &quot;A String&quot;, # [Output Only] The network peering name that should handle matching packets, which should conform to RFC1035.
         &quot;nextHopVpnTunnel&quot;: &quot;A String&quot;, # The URL to a VpnTunnel that should handle matching packets.
         &quot;priority&quot;: 42, # The priority of this route. Priority is used to break ties in cases where there is more than one matching route of equal prefix length. In cases where multiple routes have equal prefix length, the one with the lowest-numbered priority value wins. The default value is `1000`. The priority value must be from `0` to `65535`, inclusive.
+        &quot;routeType&quot;: &quot;A String&quot;, # [Output Only] The type of this route, which can be one of the following values: - &#x27;TRANSIT&#x27; for a transit route that this router learned from another Cloud Router and will readvertise to one of its BGP peers - &#x27;SUBNET&#x27; for a route from a subnet of the VPC - &#x27;BGP&#x27; for a route learned from a BGP peer of this router - &#x27;STATIC&#x27; for a static route
         &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined fully-qualified URL for this resource.
         &quot;tags&quot;: [ # A list of instance tags to which this route applies.
           &quot;A String&quot;,
@@ -608,6 +649,14 @@
     ],
     &quot;bestRoutesForRouter&quot;: [ # Best routes learned by this router.
       { # Represents a Route resource. A route defines a path from VM instances in the VPC network to a specific destination. This destination can be inside or outside the VPC network. For more information, read the Routes overview.
+        &quot;asPaths&quot;: [ # [Output Only] AS path.
+          {
+            &quot;asLists&quot;: [ # [Output Only] The AS numbers of the AS Path.
+              42,
+            ],
+            &quot;pathSegmentType&quot;: &quot;A String&quot;, # [Output Only] The type of the AS Path, which can be one of the following values: - &#x27;AS_SET&#x27;: unordered set of autonomous systems that the route in has traversed - &#x27;AS_SEQUENCE&#x27;: ordered set of autonomous systems that the route has traversed - &#x27;AS_CONFED_SEQUENCE&#x27;: ordered set of Member Autonomous Systems in the local confederation that the route has traversed - &#x27;AS_CONFED_SET&#x27;: unordered set of Member Autonomous Systems in the local confederation that the route has traversed
+          },
+        ],
         &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
         &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this field when you create the resource.
         &quot;destRange&quot;: &quot;A String&quot;, # The destination range of outgoing packets that this route applies to. Both IPv4 and IPv6 are supported.
@@ -624,6 +673,7 @@
         &quot;nextHopPeering&quot;: &quot;A String&quot;, # [Output Only] The network peering name that should handle matching packets, which should conform to RFC1035.
         &quot;nextHopVpnTunnel&quot;: &quot;A String&quot;, # The URL to a VpnTunnel that should handle matching packets.
         &quot;priority&quot;: 42, # The priority of this route. Priority is used to break ties in cases where there is more than one matching route of equal prefix length. In cases where multiple routes have equal prefix length, the one with the lowest-numbered priority value wins. The default value is `1000`. The priority value must be from `0` to `65535`, inclusive.
+        &quot;routeType&quot;: &quot;A String&quot;, # [Output Only] The type of this route, which can be one of the following values: - &#x27;TRANSIT&#x27; for a transit route that this router learned from another Cloud Router and will readvertise to one of its BGP peers - &#x27;SUBNET&#x27; for a route from a subnet of the VPC - &#x27;BGP&#x27; for a route learned from a BGP peer of this router - &#x27;STATIC&#x27; for a static route
         &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined fully-qualified URL for this resource.
         &quot;tags&quot;: [ # A list of instance tags to which this route applies.
           &quot;A String&quot;,
@@ -646,6 +696,14 @@
       {
         &quot;advertisedRoutes&quot;: [ # Routes that were advertised to the remote BGP peer
           { # Represents a Route resource. A route defines a path from VM instances in the VPC network to a specific destination. This destination can be inside or outside the VPC network. For more information, read the Routes overview.
+            &quot;asPaths&quot;: [ # [Output Only] AS path.
+              {
+                &quot;asLists&quot;: [ # [Output Only] The AS numbers of the AS Path.
+                  42,
+                ],
+                &quot;pathSegmentType&quot;: &quot;A String&quot;, # [Output Only] The type of the AS Path, which can be one of the following values: - &#x27;AS_SET&#x27;: unordered set of autonomous systems that the route in has traversed - &#x27;AS_SEQUENCE&#x27;: ordered set of autonomous systems that the route has traversed - &#x27;AS_CONFED_SEQUENCE&#x27;: ordered set of Member Autonomous Systems in the local confederation that the route has traversed - &#x27;AS_CONFED_SET&#x27;: unordered set of Member Autonomous Systems in the local confederation that the route has traversed
+              },
+            ],
             &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
             &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this field when you create the resource.
             &quot;destRange&quot;: &quot;A String&quot;, # The destination range of outgoing packets that this route applies to. Both IPv4 and IPv6 are supported.
@@ -662,6 +720,7 @@
             &quot;nextHopPeering&quot;: &quot;A String&quot;, # [Output Only] The network peering name that should handle matching packets, which should conform to RFC1035.
             &quot;nextHopVpnTunnel&quot;: &quot;A String&quot;, # The URL to a VpnTunnel that should handle matching packets.
             &quot;priority&quot;: 42, # The priority of this route. Priority is used to break ties in cases where there is more than one matching route of equal prefix length. In cases where multiple routes have equal prefix length, the one with the lowest-numbered priority value wins. The default value is `1000`. The priority value must be from `0` to `65535`, inclusive.
+            &quot;routeType&quot;: &quot;A String&quot;, # [Output Only] The type of this route, which can be one of the following values: - &#x27;TRANSIT&#x27; for a transit route that this router learned from another Cloud Router and will readvertise to one of its BGP peers - &#x27;SUBNET&#x27; for a route from a subnet of the VPC - &#x27;BGP&#x27; for a route learned from a BGP peer of this router - &#x27;STATIC&#x27; for a static route
             &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined fully-qualified URL for this resource.
             &quot;tags&quot;: [ # A list of instance tags to which this route applies.
               &quot;A String&quot;,
@@ -766,6 +825,19 @@
         &quot;minExtraNatIpsNeeded&quot;: 42, # The number of extra IPs to allocate. This will be greater than 0 only if user-specified IPs are NOT enough to allow all configured VMs to use NAT. This value is meaningful only when auto-allocation of NAT IPs is *not* used.
         &quot;name&quot;: &quot;A String&quot;, # Unique name of this NAT.
         &quot;numVmEndpointsWithNatMappings&quot;: 42, # Number of VM endpoints (i.e., Nics) that can use NAT.
+        &quot;ruleStatus&quot;: [ # Status of rules in this NAT.
+          { # Status of a NAT Rule contained in this NAT.
+            &quot;activeNatIps&quot;: [ # A list of active IPs for NAT. Example: [&quot;1.1.1.1&quot;, &quot;179.12.26.133&quot;].
+              &quot;A String&quot;,
+            ],
+            &quot;drainNatIps&quot;: [ # A list of IPs for NAT that are in drain mode. Example: [&quot;1.1.1.1&quot;, &quot;179.12.26.133&quot;].
+              &quot;A String&quot;,
+            ],
+            &quot;minExtraIpsNeeded&quot;: 42, # The number of extra IPs to allocate. This will be greater than 0 only if the existing IPs in this NAT Rule are NOT enough to allow all configured VMs to use NAT.
+            &quot;numVmEndpointsWithNatMappings&quot;: 42, # Number of VM endpoints (i.e., NICs) that have NAT Mappings from this NAT Rule.
+            &quot;ruleNumber&quot;: 42, # Rule number of the rule.
+          },
+        ],
         &quot;userAllocatedNatIpResources&quot;: [ # A list of fully qualified URLs of reserved IP address resources.
           &quot;A String&quot;,
         ],
@@ -868,6 +940,21 @@
       &quot;natIps&quot;: [ # A list of URLs of the IP resources used for this Nat service. These IP addresses must be valid static external IP addresses assigned to the project.
         &quot;A String&quot;,
       ],
+      &quot;rules&quot;: [ # A list of rules associated with this NAT.
+        {
+          &quot;action&quot;: { # The action to be enforced for traffic that matches this rule.
+            &quot;sourceNatActiveIps&quot;: [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project. This field is used for public NAT.
+              &quot;A String&quot;,
+            ],
+            &quot;sourceNatDrainIps&quot;: [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only. This field is used for public NAT.
+              &quot;A String&quot;,
+            ],
+          },
+          &quot;description&quot;: &quot;A String&quot;, # An optional description of this rule.
+          &quot;match&quot;: &quot;A String&quot;, # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions for public NAT: &quot;inIpRange(destination.ip, &#x27;1.1.0.0/16&#x27;) || inIpRange(destination.ip, &#x27;2.2.0.0/16&#x27;)&quot; &quot;destination.ip == &#x27;1.1.0.1&#x27; || destination.ip == &#x27;8.8.8.8&#x27;&quot; The following example is a valid match expression for private NAT: &quot;nexthop.hub == &#x27;/projects/my-project/global/hub/hub-1&#x27;&quot;
+          &quot;ruleNumber&quot;: 42, # An integer uniquely identifying a rule in the list. The rule number must be a positive value between 0 and 65000, and must be unique among rules within a NAT.
+        },
+      ],
       &quot;sourceSubnetworkIpRangesToNat&quot;: &quot;A String&quot;, # Specify the Nat option, which can take one of the following values: - ALL_SUBNETWORKS_ALL_IP_RANGES: All of the IP ranges in every Subnetwork are allowed to Nat. - ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES: All of the primary IP ranges in every Subnetwork are allowed to Nat. - LIST_OF_SUBNETWORKS: A list of Subnetworks are allowed to Nat (specified in the field subnetwork below) The default is SUBNETWORK_IP_RANGE_TO_NAT_OPTION_UNSPECIFIED. Note that if this field contains ALL_SUBNETWORKS_ALL_IP_RANGES or ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, then there should not be any other Router.Nat section in any Router for this network in this region.
       &quot;subnetworks&quot;: [ # A list of Subnetwork resources whose traffic should be translated by NAT Gateway. It is used only when LIST_OF_SUBNETWORKS is selected for the SubnetworkIpRangeToNatOption above.
         { # Defines the IP ranges that want to use NAT for a subnetwork.
@@ -881,6 +968,7 @@
         },
       ],
       &quot;tcpEstablishedIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP established connections. Defaults to 1200s if not set.
+      &quot;tcpTimeWaitTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP connections that are in TIME_WAIT state. Defaults to 120s if not set.
       &quot;tcpTransitoryIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP transitory connections. Defaults to 30s if not set.
       &quot;udpIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for UDP connections. Defaults to 30s if not set.
     },
@@ -1048,6 +1136,21 @@
           &quot;natIps&quot;: [ # A list of URLs of the IP resources used for this Nat service. These IP addresses must be valid static external IP addresses assigned to the project.
             &quot;A String&quot;,
           ],
+          &quot;rules&quot;: [ # A list of rules associated with this NAT.
+            {
+              &quot;action&quot;: { # The action to be enforced for traffic that matches this rule.
+                &quot;sourceNatActiveIps&quot;: [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project. This field is used for public NAT.
+                  &quot;A String&quot;,
+                ],
+                &quot;sourceNatDrainIps&quot;: [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only. This field is used for public NAT.
+                  &quot;A String&quot;,
+                ],
+              },
+              &quot;description&quot;: &quot;A String&quot;, # An optional description of this rule.
+              &quot;match&quot;: &quot;A String&quot;, # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions for public NAT: &quot;inIpRange(destination.ip, &#x27;1.1.0.0/16&#x27;) || inIpRange(destination.ip, &#x27;2.2.0.0/16&#x27;)&quot; &quot;destination.ip == &#x27;1.1.0.1&#x27; || destination.ip == &#x27;8.8.8.8&#x27;&quot; The following example is a valid match expression for private NAT: &quot;nexthop.hub == &#x27;/projects/my-project/global/hub/hub-1&#x27;&quot;
+              &quot;ruleNumber&quot;: 42, # An integer uniquely identifying a rule in the list. The rule number must be a positive value between 0 and 65000, and must be unique among rules within a NAT.
+            },
+          ],
           &quot;sourceSubnetworkIpRangesToNat&quot;: &quot;A String&quot;, # Specify the Nat option, which can take one of the following values: - ALL_SUBNETWORKS_ALL_IP_RANGES: All of the IP ranges in every Subnetwork are allowed to Nat. - ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES: All of the primary IP ranges in every Subnetwork are allowed to Nat. - LIST_OF_SUBNETWORKS: A list of Subnetworks are allowed to Nat (specified in the field subnetwork below) The default is SUBNETWORK_IP_RANGE_TO_NAT_OPTION_UNSPECIFIED. Note that if this field contains ALL_SUBNETWORKS_ALL_IP_RANGES or ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, then there should not be any other Router.Nat section in any Router for this network in this region.
           &quot;subnetworks&quot;: [ # A list of Subnetwork resources whose traffic should be translated by NAT Gateway. It is used only when LIST_OF_SUBNETWORKS is selected for the SubnetworkIpRangeToNatOption above.
             { # Defines the IP ranges that want to use NAT for a subnetwork.
@@ -1061,6 +1164,7 @@
             },
           ],
           &quot;tcpEstablishedIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP established connections. Defaults to 1200s if not set.
+          &quot;tcpTimeWaitTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP connections that are in TIME_WAIT state. Defaults to 120s if not set.
           &quot;tcpTransitoryIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP transitory connections. Defaults to 30s if not set.
           &quot;udpIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for UDP connections. Defaults to 30s if not set.
         },
@@ -1190,6 +1294,21 @@
       &quot;natIps&quot;: [ # A list of URLs of the IP resources used for this Nat service. These IP addresses must be valid static external IP addresses assigned to the project.
         &quot;A String&quot;,
       ],
+      &quot;rules&quot;: [ # A list of rules associated with this NAT.
+        {
+          &quot;action&quot;: { # The action to be enforced for traffic that matches this rule.
+            &quot;sourceNatActiveIps&quot;: [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project. This field is used for public NAT.
+              &quot;A String&quot;,
+            ],
+            &quot;sourceNatDrainIps&quot;: [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only. This field is used for public NAT.
+              &quot;A String&quot;,
+            ],
+          },
+          &quot;description&quot;: &quot;A String&quot;, # An optional description of this rule.
+          &quot;match&quot;: &quot;A String&quot;, # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions for public NAT: &quot;inIpRange(destination.ip, &#x27;1.1.0.0/16&#x27;) || inIpRange(destination.ip, &#x27;2.2.0.0/16&#x27;)&quot; &quot;destination.ip == &#x27;1.1.0.1&#x27; || destination.ip == &#x27;8.8.8.8&#x27;&quot; The following example is a valid match expression for private NAT: &quot;nexthop.hub == &#x27;/projects/my-project/global/hub/hub-1&#x27;&quot;
+          &quot;ruleNumber&quot;: 42, # An integer uniquely identifying a rule in the list. The rule number must be a positive value between 0 and 65000, and must be unique among rules within a NAT.
+        },
+      ],
       &quot;sourceSubnetworkIpRangesToNat&quot;: &quot;A String&quot;, # Specify the Nat option, which can take one of the following values: - ALL_SUBNETWORKS_ALL_IP_RANGES: All of the IP ranges in every Subnetwork are allowed to Nat. - ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES: All of the primary IP ranges in every Subnetwork are allowed to Nat. - LIST_OF_SUBNETWORKS: A list of Subnetworks are allowed to Nat (specified in the field subnetwork below) The default is SUBNETWORK_IP_RANGE_TO_NAT_OPTION_UNSPECIFIED. Note that if this field contains ALL_SUBNETWORKS_ALL_IP_RANGES or ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, then there should not be any other Router.Nat section in any Router for this network in this region.
       &quot;subnetworks&quot;: [ # A list of Subnetwork resources whose traffic should be translated by NAT Gateway. It is used only when LIST_OF_SUBNETWORKS is selected for the SubnetworkIpRangeToNatOption above.
         { # Defines the IP ranges that want to use NAT for a subnetwork.
@@ -1203,6 +1322,7 @@
         },
       ],
       &quot;tcpEstablishedIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP established connections. Defaults to 1200s if not set.
+      &quot;tcpTimeWaitTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP connections that are in TIME_WAIT state. Defaults to 120s if not set.
       &quot;tcpTransitoryIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP transitory connections. Defaults to 30s if not set.
       &quot;udpIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for UDP connections. Defaults to 30s if not set.
     },
@@ -1358,6 +1478,21 @@
       &quot;natIps&quot;: [ # A list of URLs of the IP resources used for this Nat service. These IP addresses must be valid static external IP addresses assigned to the project.
         &quot;A String&quot;,
       ],
+      &quot;rules&quot;: [ # A list of rules associated with this NAT.
+        {
+          &quot;action&quot;: { # The action to be enforced for traffic that matches this rule.
+            &quot;sourceNatActiveIps&quot;: [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project. This field is used for public NAT.
+              &quot;A String&quot;,
+            ],
+            &quot;sourceNatDrainIps&quot;: [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only. This field is used for public NAT.
+              &quot;A String&quot;,
+            ],
+          },
+          &quot;description&quot;: &quot;A String&quot;, # An optional description of this rule.
+          &quot;match&quot;: &quot;A String&quot;, # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions for public NAT: &quot;inIpRange(destination.ip, &#x27;1.1.0.0/16&#x27;) || inIpRange(destination.ip, &#x27;2.2.0.0/16&#x27;)&quot; &quot;destination.ip == &#x27;1.1.0.1&#x27; || destination.ip == &#x27;8.8.8.8&#x27;&quot; The following example is a valid match expression for private NAT: &quot;nexthop.hub == &#x27;/projects/my-project/global/hub/hub-1&#x27;&quot;
+          &quot;ruleNumber&quot;: 42, # An integer uniquely identifying a rule in the list. The rule number must be a positive value between 0 and 65000, and must be unique among rules within a NAT.
+        },
+      ],
       &quot;sourceSubnetworkIpRangesToNat&quot;: &quot;A String&quot;, # Specify the Nat option, which can take one of the following values: - ALL_SUBNETWORKS_ALL_IP_RANGES: All of the IP ranges in every Subnetwork are allowed to Nat. - ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES: All of the primary IP ranges in every Subnetwork are allowed to Nat. - LIST_OF_SUBNETWORKS: A list of Subnetworks are allowed to Nat (specified in the field subnetwork below) The default is SUBNETWORK_IP_RANGE_TO_NAT_OPTION_UNSPECIFIED. Note that if this field contains ALL_SUBNETWORKS_ALL_IP_RANGES or ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, then there should not be any other Router.Nat section in any Router for this network in this region.
       &quot;subnetworks&quot;: [ # A list of Subnetwork resources whose traffic should be translated by NAT Gateway. It is used only when LIST_OF_SUBNETWORKS is selected for the SubnetworkIpRangeToNatOption above.
         { # Defines the IP ranges that want to use NAT for a subnetwork.
@@ -1371,6 +1506,7 @@
         },
       ],
       &quot;tcpEstablishedIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP established connections. Defaults to 1200s if not set.
+      &quot;tcpTimeWaitTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP connections that are in TIME_WAIT state. Defaults to 120s if not set.
       &quot;tcpTransitoryIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP transitory connections. Defaults to 30s if not set.
       &quot;udpIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for UDP connections. Defaults to 30s if not set.
     },
@@ -1468,6 +1604,21 @@
         &quot;natIps&quot;: [ # A list of URLs of the IP resources used for this Nat service. These IP addresses must be valid static external IP addresses assigned to the project.
           &quot;A String&quot;,
         ],
+        &quot;rules&quot;: [ # A list of rules associated with this NAT.
+          {
+            &quot;action&quot;: { # The action to be enforced for traffic that matches this rule.
+              &quot;sourceNatActiveIps&quot;: [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project. This field is used for public NAT.
+                &quot;A String&quot;,
+              ],
+              &quot;sourceNatDrainIps&quot;: [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only. This field is used for public NAT.
+                &quot;A String&quot;,
+              ],
+            },
+            &quot;description&quot;: &quot;A String&quot;, # An optional description of this rule.
+            &quot;match&quot;: &quot;A String&quot;, # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions for public NAT: &quot;inIpRange(destination.ip, &#x27;1.1.0.0/16&#x27;) || inIpRange(destination.ip, &#x27;2.2.0.0/16&#x27;)&quot; &quot;destination.ip == &#x27;1.1.0.1&#x27; || destination.ip == &#x27;8.8.8.8&#x27;&quot; The following example is a valid match expression for private NAT: &quot;nexthop.hub == &#x27;/projects/my-project/global/hub/hub-1&#x27;&quot;
+            &quot;ruleNumber&quot;: 42, # An integer uniquely identifying a rule in the list. The rule number must be a positive value between 0 and 65000, and must be unique among rules within a NAT.
+          },
+        ],
         &quot;sourceSubnetworkIpRangesToNat&quot;: &quot;A String&quot;, # Specify the Nat option, which can take one of the following values: - ALL_SUBNETWORKS_ALL_IP_RANGES: All of the IP ranges in every Subnetwork are allowed to Nat. - ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES: All of the primary IP ranges in every Subnetwork are allowed to Nat. - LIST_OF_SUBNETWORKS: A list of Subnetworks are allowed to Nat (specified in the field subnetwork below) The default is SUBNETWORK_IP_RANGE_TO_NAT_OPTION_UNSPECIFIED. Note that if this field contains ALL_SUBNETWORKS_ALL_IP_RANGES or ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, then there should not be any other Router.Nat section in any Router for this network in this region.
         &quot;subnetworks&quot;: [ # A list of Subnetwork resources whose traffic should be translated by NAT Gateway. It is used only when LIST_OF_SUBNETWORKS is selected for the SubnetworkIpRangeToNatOption above.
           { # Defines the IP ranges that want to use NAT for a subnetwork.
@@ -1481,6 +1632,7 @@
           },
         ],
         &quot;tcpEstablishedIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP established connections. Defaults to 1200s if not set.
+        &quot;tcpTimeWaitTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP connections that are in TIME_WAIT state. Defaults to 120s if not set.
         &quot;tcpTransitoryIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP transitory connections. Defaults to 30s if not set.
         &quot;udpIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for UDP connections. Defaults to 30s if not set.
       },
@@ -1614,6 +1766,21 @@
       &quot;natIps&quot;: [ # A list of URLs of the IP resources used for this Nat service. These IP addresses must be valid static external IP addresses assigned to the project.
         &quot;A String&quot;,
       ],
+      &quot;rules&quot;: [ # A list of rules associated with this NAT.
+        {
+          &quot;action&quot;: { # The action to be enforced for traffic that matches this rule.
+            &quot;sourceNatActiveIps&quot;: [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project. This field is used for public NAT.
+              &quot;A String&quot;,
+            ],
+            &quot;sourceNatDrainIps&quot;: [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only. This field is used for public NAT.
+              &quot;A String&quot;,
+            ],
+          },
+          &quot;description&quot;: &quot;A String&quot;, # An optional description of this rule.
+          &quot;match&quot;: &quot;A String&quot;, # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions for public NAT: &quot;inIpRange(destination.ip, &#x27;1.1.0.0/16&#x27;) || inIpRange(destination.ip, &#x27;2.2.0.0/16&#x27;)&quot; &quot;destination.ip == &#x27;1.1.0.1&#x27; || destination.ip == &#x27;8.8.8.8&#x27;&quot; The following example is a valid match expression for private NAT: &quot;nexthop.hub == &#x27;/projects/my-project/global/hub/hub-1&#x27;&quot;
+          &quot;ruleNumber&quot;: 42, # An integer uniquely identifying a rule in the list. The rule number must be a positive value between 0 and 65000, and must be unique among rules within a NAT.
+        },
+      ],
       &quot;sourceSubnetworkIpRangesToNat&quot;: &quot;A String&quot;, # Specify the Nat option, which can take one of the following values: - ALL_SUBNETWORKS_ALL_IP_RANGES: All of the IP ranges in every Subnetwork are allowed to Nat. - ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES: All of the primary IP ranges in every Subnetwork are allowed to Nat. - LIST_OF_SUBNETWORKS: A list of Subnetworks are allowed to Nat (specified in the field subnetwork below) The default is SUBNETWORK_IP_RANGE_TO_NAT_OPTION_UNSPECIFIED. Note that if this field contains ALL_SUBNETWORKS_ALL_IP_RANGES or ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, then there should not be any other Router.Nat section in any Router for this network in this region.
       &quot;subnetworks&quot;: [ # A list of Subnetwork resources whose traffic should be translated by NAT Gateway. It is used only when LIST_OF_SUBNETWORKS is selected for the SubnetworkIpRangeToNatOption above.
         { # Defines the IP ranges that want to use NAT for a subnetwork.
@@ -1627,6 +1794,7 @@
         },
       ],
       &quot;tcpEstablishedIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP established connections. Defaults to 1200s if not set.
+      &quot;tcpTimeWaitTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP connections that are in TIME_WAIT state. Defaults to 120s if not set.
       &quot;tcpTransitoryIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP transitory connections. Defaults to 30s if not set.
       &quot;udpIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for UDP connections. Defaults to 30s if not set.
     },
diff --git a/docs/dyn/compute_beta.routes.html b/docs/dyn/compute_beta.routes.html
index c3536bd..12836e9 100644
--- a/docs/dyn/compute_beta.routes.html
+++ b/docs/dyn/compute_beta.routes.html
@@ -180,6 +180,14 @@
   An object of the form:
 
     { # Represents a Route resource. A route defines a path from VM instances in the VPC network to a specific destination. This destination can be inside or outside the VPC network. For more information, read the Routes overview.
+  &quot;asPaths&quot;: [ # [Output Only] AS path.
+    {
+      &quot;asLists&quot;: [ # [Output Only] The AS numbers of the AS Path.
+        42,
+      ],
+      &quot;pathSegmentType&quot;: &quot;A String&quot;, # [Output Only] The type of the AS Path, which can be one of the following values: - &#x27;AS_SET&#x27;: unordered set of autonomous systems that the route in has traversed - &#x27;AS_SEQUENCE&#x27;: ordered set of autonomous systems that the route has traversed - &#x27;AS_CONFED_SEQUENCE&#x27;: ordered set of Member Autonomous Systems in the local confederation that the route has traversed - &#x27;AS_CONFED_SET&#x27;: unordered set of Member Autonomous Systems in the local confederation that the route has traversed
+    },
+  ],
   &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
   &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this field when you create the resource.
   &quot;destRange&quot;: &quot;A String&quot;, # The destination range of outgoing packets that this route applies to. Both IPv4 and IPv6 are supported.
@@ -196,6 +204,7 @@
   &quot;nextHopPeering&quot;: &quot;A String&quot;, # [Output Only] The network peering name that should handle matching packets, which should conform to RFC1035.
   &quot;nextHopVpnTunnel&quot;: &quot;A String&quot;, # The URL to a VpnTunnel that should handle matching packets.
   &quot;priority&quot;: 42, # The priority of this route. Priority is used to break ties in cases where there is more than one matching route of equal prefix length. In cases where multiple routes have equal prefix length, the one with the lowest-numbered priority value wins. The default value is `1000`. The priority value must be from `0` to `65535`, inclusive.
+  &quot;routeType&quot;: &quot;A String&quot;, # [Output Only] The type of this route, which can be one of the following values: - &#x27;TRANSIT&#x27; for a transit route that this router learned from another Cloud Router and will readvertise to one of its BGP peers - &#x27;SUBNET&#x27; for a route from a subnet of the VPC - &#x27;BGP&#x27; for a route learned from a BGP peer of this router - &#x27;STATIC&#x27; for a static route
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined fully-qualified URL for this resource.
   &quot;tags&quot;: [ # A list of instance tags to which this route applies.
     &quot;A String&quot;,
@@ -225,6 +234,14 @@
     The object takes the form of:
 
 { # Represents a Route resource. A route defines a path from VM instances in the VPC network to a specific destination. This destination can be inside or outside the VPC network. For more information, read the Routes overview.
+  &quot;asPaths&quot;: [ # [Output Only] AS path.
+    {
+      &quot;asLists&quot;: [ # [Output Only] The AS numbers of the AS Path.
+        42,
+      ],
+      &quot;pathSegmentType&quot;: &quot;A String&quot;, # [Output Only] The type of the AS Path, which can be one of the following values: - &#x27;AS_SET&#x27;: unordered set of autonomous systems that the route in has traversed - &#x27;AS_SEQUENCE&#x27;: ordered set of autonomous systems that the route has traversed - &#x27;AS_CONFED_SEQUENCE&#x27;: ordered set of Member Autonomous Systems in the local confederation that the route has traversed - &#x27;AS_CONFED_SET&#x27;: unordered set of Member Autonomous Systems in the local confederation that the route has traversed
+    },
+  ],
   &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
   &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this field when you create the resource.
   &quot;destRange&quot;: &quot;A String&quot;, # The destination range of outgoing packets that this route applies to. Both IPv4 and IPv6 are supported.
@@ -241,6 +258,7 @@
   &quot;nextHopPeering&quot;: &quot;A String&quot;, # [Output Only] The network peering name that should handle matching packets, which should conform to RFC1035.
   &quot;nextHopVpnTunnel&quot;: &quot;A String&quot;, # The URL to a VpnTunnel that should handle matching packets.
   &quot;priority&quot;: 42, # The priority of this route. Priority is used to break ties in cases where there is more than one matching route of equal prefix length. In cases where multiple routes have equal prefix length, the one with the lowest-numbered priority value wins. The default value is `1000`. The priority value must be from `0` to `65535`, inclusive.
+  &quot;routeType&quot;: &quot;A String&quot;, # [Output Only] The type of this route, which can be one of the following values: - &#x27;TRANSIT&#x27; for a transit route that this router learned from another Cloud Router and will readvertise to one of its BGP peers - &#x27;SUBNET&#x27; for a route from a subnet of the VPC - &#x27;BGP&#x27; for a route learned from a BGP peer of this router - &#x27;STATIC&#x27; for a static route
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined fully-qualified URL for this resource.
   &quot;tags&quot;: [ # A list of instance tags to which this route applies.
     &quot;A String&quot;,
@@ -338,6 +356,14 @@
   &quot;id&quot;: &quot;A String&quot;, # [Output Only] Unique identifier for the resource; defined by the server.
   &quot;items&quot;: [ # A list of Route resources.
     { # Represents a Route resource. A route defines a path from VM instances in the VPC network to a specific destination. This destination can be inside or outside the VPC network. For more information, read the Routes overview.
+      &quot;asPaths&quot;: [ # [Output Only] AS path.
+        {
+          &quot;asLists&quot;: [ # [Output Only] The AS numbers of the AS Path.
+            42,
+          ],
+          &quot;pathSegmentType&quot;: &quot;A String&quot;, # [Output Only] The type of the AS Path, which can be one of the following values: - &#x27;AS_SET&#x27;: unordered set of autonomous systems that the route in has traversed - &#x27;AS_SEQUENCE&#x27;: ordered set of autonomous systems that the route has traversed - &#x27;AS_CONFED_SEQUENCE&#x27;: ordered set of Member Autonomous Systems in the local confederation that the route has traversed - &#x27;AS_CONFED_SET&#x27;: unordered set of Member Autonomous Systems in the local confederation that the route has traversed
+        },
+      ],
       &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
       &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this field when you create the resource.
       &quot;destRange&quot;: &quot;A String&quot;, # The destination range of outgoing packets that this route applies to. Both IPv4 and IPv6 are supported.
@@ -354,6 +380,7 @@
       &quot;nextHopPeering&quot;: &quot;A String&quot;, # [Output Only] The network peering name that should handle matching packets, which should conform to RFC1035.
       &quot;nextHopVpnTunnel&quot;: &quot;A String&quot;, # The URL to a VpnTunnel that should handle matching packets.
       &quot;priority&quot;: 42, # The priority of this route. Priority is used to break ties in cases where there is more than one matching route of equal prefix length. In cases where multiple routes have equal prefix length, the one with the lowest-numbered priority value wins. The default value is `1000`. The priority value must be from `0` to `65535`, inclusive.
+      &quot;routeType&quot;: &quot;A String&quot;, # [Output Only] The type of this route, which can be one of the following values: - &#x27;TRANSIT&#x27; for a transit route that this router learned from another Cloud Router and will readvertise to one of its BGP peers - &#x27;SUBNET&#x27; for a route from a subnet of the VPC - &#x27;BGP&#x27; for a route learned from a BGP peer of this router - &#x27;STATIC&#x27; for a static route
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined fully-qualified URL for this resource.
       &quot;tags&quot;: [ # A list of instance tags to which this route applies.
         &quot;A String&quot;,
diff --git a/docs/dyn/compute_beta.snapshots.html b/docs/dyn/compute_beta.snapshots.html
index ce11ce2..1bf4161 100644
--- a/docs/dyn/compute_beta.snapshots.html
+++ b/docs/dyn/compute_beta.snapshots.html
@@ -213,18 +213,18 @@
   &quot;satisfiesPzs&quot;: True or False, # [Output Only] Reserved for future use.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;snapshotEncryptionKey&quot;: { # Encrypts the snapshot using a customer-supplied encryption key. After you encrypt a snapshot using a customer-supplied key, you must provide the same key if you use the snapshot later. For example, you must provide the encryption key when you create a disk from the encrypted snapshot in a future request. Customer-supplied encryption keys do not protect access to metadata of the snapshot. If you do not provide an encryption key when creating the snapshot, then the snapshot will be encrypted using an automatically generated key and you do not need to provide a key to use the snapshot later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDisk&quot;: &quot;A String&quot;, # The source disk used to create this snapshot.
   &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this snapshot. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given disk name.
@@ -378,18 +378,18 @@
   &quot;satisfiesPzs&quot;: True or False, # [Output Only] Reserved for future use.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;snapshotEncryptionKey&quot;: { # Encrypts the snapshot using a customer-supplied encryption key. After you encrypt a snapshot using a customer-supplied key, you must provide the same key if you use the snapshot later. For example, you must provide the encryption key when you create a disk from the encrypted snapshot in a future request. Customer-supplied encryption keys do not protect access to metadata of the snapshot. If you do not provide an encryption key when creating the snapshot, then the snapshot will be encrypted using an automatically generated key and you do not need to provide a key to use the snapshot later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDisk&quot;: &quot;A String&quot;, # The source disk used to create this snapshot.
   &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this snapshot. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given disk name.
@@ -507,18 +507,18 @@
       &quot;satisfiesPzs&quot;: True or False, # [Output Only] Reserved for future use.
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
       &quot;snapshotEncryptionKey&quot;: { # Encrypts the snapshot using a customer-supplied encryption key. After you encrypt a snapshot using a customer-supplied key, you must provide the same key if you use the snapshot later. For example, you must provide the encryption key when you create a disk from the encrypted snapshot in a future request. Customer-supplied encryption keys do not protect access to metadata of the snapshot. If you do not provide an encryption key when creating the snapshot, then the snapshot will be encrypted using an automatically generated key and you do not need to provide a key to use the snapshot later.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceDisk&quot;: &quot;A String&quot;, # The source disk used to create this snapshot.
       &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this snapshot. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given disk name.
diff --git a/docs/dyn/compute_v1.backendServices.html b/docs/dyn/compute_v1.backendServices.html
index 3f46e9f..72e77f0 100644
--- a/docs/dyn/compute_v1.backendServices.html
+++ b/docs/dyn/compute_v1.backendServices.html
@@ -358,6 +358,9 @@
           },
           &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
           &quot;sessionAffinity&quot;: &quot;A String&quot;, # Type of session affinity to use. The default is NONE. For a detailed description of session affinity options, see: [Session affinity](https://cloud.google.com/load-balancing/docs/backend-service#session_affinity). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
+          &quot;subsetting&quot;: { # Subsetting configuration for this BackendService. Currently this is applicable only for Internal TCP/UDP load balancing, Internal HTTP(S) load balancing and Traffic Director.
+            &quot;policy&quot;: &quot;A String&quot;,
+          },
           &quot;timeoutSec&quot;: 42, # Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true. Instead, use maxStreamDuration.
         },
       ],
@@ -698,6 +701,9 @@
   },
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;sessionAffinity&quot;: &quot;A String&quot;, # Type of session affinity to use. The default is NONE. For a detailed description of session affinity options, see: [Session affinity](https://cloud.google.com/load-balancing/docs/backend-service#session_affinity). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
+  &quot;subsetting&quot;: { # Subsetting configuration for this BackendService. Currently this is applicable only for Internal TCP/UDP load balancing, Internal HTTP(S) load balancing and Traffic Director.
+    &quot;policy&quot;: &quot;A String&quot;,
+  },
   &quot;timeoutSec&quot;: 42, # Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true. Instead, use maxStreamDuration.
 }</pre>
 </div>
@@ -901,6 +907,9 @@
   },
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;sessionAffinity&quot;: &quot;A String&quot;, # Type of session affinity to use. The default is NONE. For a detailed description of session affinity options, see: [Session affinity](https://cloud.google.com/load-balancing/docs/backend-service#session_affinity). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
+  &quot;subsetting&quot;: { # Subsetting configuration for this BackendService. Currently this is applicable only for Internal TCP/UDP load balancing, Internal HTTP(S) load balancing and Traffic Director.
+    &quot;policy&quot;: &quot;A String&quot;,
+  },
   &quot;timeoutSec&quot;: 42, # Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true. Instead, use maxStreamDuration.
 }
 
@@ -1127,6 +1136,9 @@
       },
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
       &quot;sessionAffinity&quot;: &quot;A String&quot;, # Type of session affinity to use. The default is NONE. For a detailed description of session affinity options, see: [Session affinity](https://cloud.google.com/load-balancing/docs/backend-service#session_affinity). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
+      &quot;subsetting&quot;: { # Subsetting configuration for this BackendService. Currently this is applicable only for Internal TCP/UDP load balancing, Internal HTTP(S) load balancing and Traffic Director.
+        &quot;policy&quot;: &quot;A String&quot;,
+      },
       &quot;timeoutSec&quot;: 42, # Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true. Instead, use maxStreamDuration.
     },
   ],
@@ -1315,6 +1327,9 @@
   },
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;sessionAffinity&quot;: &quot;A String&quot;, # Type of session affinity to use. The default is NONE. For a detailed description of session affinity options, see: [Session affinity](https://cloud.google.com/load-balancing/docs/backend-service#session_affinity). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
+  &quot;subsetting&quot;: { # Subsetting configuration for this BackendService. Currently this is applicable only for Internal TCP/UDP load balancing, Internal HTTP(S) load balancing and Traffic Director.
+    &quot;policy&quot;: &quot;A String&quot;,
+  },
   &quot;timeoutSec&quot;: 42, # Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true. Instead, use maxStreamDuration.
 }
 
@@ -1599,6 +1614,9 @@
   },
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;sessionAffinity&quot;: &quot;A String&quot;, # Type of session affinity to use. The default is NONE. For a detailed description of session affinity options, see: [Session affinity](https://cloud.google.com/load-balancing/docs/backend-service#session_affinity). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
+  &quot;subsetting&quot;: { # Subsetting configuration for this BackendService. Currently this is applicable only for Internal TCP/UDP load balancing, Internal HTTP(S) load balancing and Traffic Director.
+    &quot;policy&quot;: &quot;A String&quot;,
+  },
   &quot;timeoutSec&quot;: 42, # Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true. Instead, use maxStreamDuration.
 }
 
diff --git a/docs/dyn/compute_v1.disks.html b/docs/dyn/compute_v1.disks.html
index 92d2c80..4747409 100644
--- a/docs/dyn/compute_v1.disks.html
+++ b/docs/dyn/compute_v1.disks.html
@@ -225,10 +225,10 @@
           &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
           &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
           &quot;diskEncryptionKey&quot;: { # Encrypts the disk using a customer-supplied encryption key or a customer-managed encryption key. Encryption keys do not protect access to metadata of the disk. After you encrypt a disk with a customer-supplied key, you must provide the same key if you use the disk later. For example, to create a disk snapshot, to create a disk image, to create a machine image, or to attach the disk to a virtual machine. After you encrypt a disk with a customer-managed key, the diskEncryptionKey.kmsKeyName is set to a key *version* name once the disk is created. The disk is encrypted with this version of the key. In the response, diskEncryptionKey.kmsKeyName appears in the following format: &quot;diskEncryptionKey.kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key /cryptoKeysVersions/version If you do not provide an encryption key when creating the disk, then the disk is encrypted using an automatically generated key and you don&#x27;t need to provide a key to use the disk later.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;guestOsFeatures&quot;: [ # A list of features to enable on the guest operating system. Applicable only for bootable images. Read Enabling guest operating system features to see a list of available options.
@@ -269,19 +269,19 @@
           &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the disk used to create this disk. This value identifies the exact disk that was used to create this persistent disk. For example, if you created the persistent disk from a disk that was later deleted and recreated under the same name, the source disk ID would identify the exact version of the disk that was used.
           &quot;sourceImage&quot;: &quot;A String&quot;, # The source image used to create this disk. If the source image is deleted, this field will not be set. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family
           &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
           &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/snapshots/snapshot - projects/project/global/snapshots/snapshot - global/snapshots/snapshot
           &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.
@@ -379,18 +379,18 @@
   &quot;satisfiesPzs&quot;: True or False, # [Output Only] Reserved for future use.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;snapshotEncryptionKey&quot;: { # Encrypts the snapshot using a customer-supplied encryption key. After you encrypt a snapshot using a customer-supplied key, you must provide the same key if you use the snapshot later. For example, you must provide the encryption key when you create a disk from the encrypted snapshot in a future request. Customer-supplied encryption keys do not protect access to metadata of the snapshot. If you do not provide an encryption key when creating the snapshot, then the snapshot will be encrypted using an automatically generated key and you do not need to provide a key to use the snapshot later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDisk&quot;: &quot;A String&quot;, # The source disk used to create this snapshot.
   &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this snapshot. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given disk name.
@@ -543,10 +543,10 @@
   &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
   &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
   &quot;diskEncryptionKey&quot;: { # Encrypts the disk using a customer-supplied encryption key or a customer-managed encryption key. Encryption keys do not protect access to metadata of the disk. After you encrypt a disk with a customer-supplied key, you must provide the same key if you use the disk later. For example, to create a disk snapshot, to create a disk image, to create a machine image, or to attach the disk to a virtual machine. After you encrypt a disk with a customer-managed key, the diskEncryptionKey.kmsKeyName is set to a key *version* name once the disk is created. The disk is encrypted with this version of the key. In the response, diskEncryptionKey.kmsKeyName appears in the following format: &quot;diskEncryptionKey.kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key /cryptoKeysVersions/version If you do not provide an encryption key when creating the disk, then the disk is encrypted using an automatically generated key and you don&#x27;t need to provide a key to use the disk later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;guestOsFeatures&quot;: [ # A list of features to enable on the guest operating system. Applicable only for bootable images. Read Enabling guest operating system features to see a list of available options.
@@ -587,19 +587,19 @@
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the disk used to create this disk. This value identifies the exact disk that was used to create this persistent disk. For example, if you created the persistent disk from a disk that was later deleted and recreated under the same name, the source disk ID would identify the exact version of the disk that was used.
   &quot;sourceImage&quot;: &quot;A String&quot;, # The source image used to create this disk. If the source image is deleted, this field will not be set. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family
   &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
   &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/snapshots/snapshot - projects/project/global/snapshots/snapshot - global/snapshots/snapshot
   &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.
@@ -732,10 +732,10 @@
   &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
   &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
   &quot;diskEncryptionKey&quot;: { # Encrypts the disk using a customer-supplied encryption key or a customer-managed encryption key. Encryption keys do not protect access to metadata of the disk. After you encrypt a disk with a customer-supplied key, you must provide the same key if you use the disk later. For example, to create a disk snapshot, to create a disk image, to create a machine image, or to attach the disk to a virtual machine. After you encrypt a disk with a customer-managed key, the diskEncryptionKey.kmsKeyName is set to a key *version* name once the disk is created. The disk is encrypted with this version of the key. In the response, diskEncryptionKey.kmsKeyName appears in the following format: &quot;diskEncryptionKey.kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key /cryptoKeysVersions/version If you do not provide an encryption key when creating the disk, then the disk is encrypted using an automatically generated key and you don&#x27;t need to provide a key to use the disk later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;guestOsFeatures&quot;: [ # A list of features to enable on the guest operating system. Applicable only for bootable images. Read Enabling guest operating system features to see a list of available options.
@@ -776,19 +776,19 @@
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the disk used to create this disk. This value identifies the exact disk that was used to create this persistent disk. For example, if you created the persistent disk from a disk that was later deleted and recreated under the same name, the source disk ID would identify the exact version of the disk that was used.
   &quot;sourceImage&quot;: &quot;A String&quot;, # The source image used to create this disk. If the source image is deleted, this field will not be set. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family
   &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
   &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/snapshots/snapshot - projects/project/global/snapshots/snapshot - global/snapshots/snapshot
   &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.
@@ -885,10 +885,10 @@
       &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
       &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
       &quot;diskEncryptionKey&quot;: { # Encrypts the disk using a customer-supplied encryption key or a customer-managed encryption key. Encryption keys do not protect access to metadata of the disk. After you encrypt a disk with a customer-supplied key, you must provide the same key if you use the disk later. For example, to create a disk snapshot, to create a disk image, to create a machine image, or to attach the disk to a virtual machine. After you encrypt a disk with a customer-managed key, the diskEncryptionKey.kmsKeyName is set to a key *version* name once the disk is created. The disk is encrypted with this version of the key. In the response, diskEncryptionKey.kmsKeyName appears in the following format: &quot;diskEncryptionKey.kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key /cryptoKeysVersions/version If you do not provide an encryption key when creating the disk, then the disk is encrypted using an automatically generated key and you don&#x27;t need to provide a key to use the disk later.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;guestOsFeatures&quot;: [ # A list of features to enable on the guest operating system. Applicable only for bootable images. Read Enabling guest operating system features to see a list of available options.
@@ -929,19 +929,19 @@
       &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the disk used to create this disk. This value identifies the exact disk that was used to create this persistent disk. For example, if you created the persistent disk from a disk that was later deleted and recreated under the same name, the source disk ID would identify the exact version of the disk that was used.
       &quot;sourceImage&quot;: &quot;A String&quot;, # The source image used to create this disk. If the source image is deleted, this field will not be set. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family
       &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
       &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/snapshots/snapshot - projects/project/global/snapshots/snapshot - global/snapshots/snapshot
       &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.
diff --git a/docs/dyn/compute_v1.firewalls.html b/docs/dyn/compute_v1.firewalls.html
index 0776eb6..094651e 100644
--- a/docs/dyn/compute_v1.firewalls.html
+++ b/docs/dyn/compute_v1.firewalls.html
@@ -212,7 +212,7 @@
     &quot;enable&quot;: True or False, # This field denotes whether to enable logging for a particular firewall rule.
     &quot;metadata&quot;: &quot;A String&quot;, # This field can only be specified for a particular firewall rule if logging is enabled for that rule. This field denotes whether to include or exclude metadata for firewall logs.
   },
-  &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+  &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
   &quot;network&quot;: &quot;A String&quot;, # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
   &quot;priority&quot;: 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
@@ -273,7 +273,7 @@
     &quot;enable&quot;: True or False, # This field denotes whether to enable logging for a particular firewall rule.
     &quot;metadata&quot;: &quot;A String&quot;, # This field can only be specified for a particular firewall rule if logging is enabled for that rule. This field denotes whether to include or exclude metadata for firewall logs.
   },
-  &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+  &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
   &quot;network&quot;: &quot;A String&quot;, # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
   &quot;priority&quot;: 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
@@ -402,7 +402,7 @@
         &quot;enable&quot;: True or False, # This field denotes whether to enable logging for a particular firewall rule.
         &quot;metadata&quot;: &quot;A String&quot;, # This field can only be specified for a particular firewall rule if logging is enabled for that rule. This field denotes whether to include or exclude metadata for firewall logs.
       },
-      &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+      &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
       &quot;network&quot;: &quot;A String&quot;, # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
       &quot;priority&quot;: 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
@@ -493,7 +493,7 @@
     &quot;enable&quot;: True or False, # This field denotes whether to enable logging for a particular firewall rule.
     &quot;metadata&quot;: &quot;A String&quot;, # This field can only be specified for a particular firewall rule if logging is enabled for that rule. This field denotes whether to include or exclude metadata for firewall logs.
   },
-  &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+  &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
   &quot;network&quot;: &quot;A String&quot;, # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
   &quot;priority&quot;: 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
@@ -610,7 +610,7 @@
     &quot;enable&quot;: True or False, # This field denotes whether to enable logging for a particular firewall rule.
     &quot;metadata&quot;: &quot;A String&quot;, # This field can only be specified for a particular firewall rule if logging is enabled for that rule. This field denotes whether to include or exclude metadata for firewall logs.
   },
-  &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+  &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
   &quot;network&quot;: &quot;A String&quot;, # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
   &quot;priority&quot;: 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
diff --git a/docs/dyn/compute_v1.globalOperations.html b/docs/dyn/compute_v1.globalOperations.html
index 4d47327..03ef406 100644
--- a/docs/dyn/compute_v1.globalOperations.html
+++ b/docs/dyn/compute_v1.globalOperations.html
@@ -88,7 +88,7 @@
 <p class="firstline">Deletes the specified Operations resource.</p>
 <p class="toc_element">
   <code><a href="#get">get(project, operation, x__xgafv=None)</a></code></p>
-<p class="firstline">Retrieves the specified Operations resource. Gets a list of operations by making a `list()` request.</p>
+<p class="firstline">Retrieves the specified Operations resource.</p>
 <p class="toc_element">
   <code><a href="#list">list(project, filter=None, maxResults=None, orderBy=None, pageToken=None, returnPartialSuccess=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Retrieves a list of Operation resources contained within the specified project.</p>
@@ -236,7 +236,7 @@
 
 <div class="method">
     <code class="details" id="get">get(project, operation, x__xgafv=None)</code>
-  <pre>Retrieves the specified Operations resource. Gets a list of operations by making a `list()` request.
+  <pre>Retrieves the specified Operations resource.
 
 Args:
   project: string, Project ID for this request. (required)
diff --git a/docs/dyn/compute_v1.imageFamilyViews.html b/docs/dyn/compute_v1.imageFamilyViews.html
index f1a8006..f12a642 100644
--- a/docs/dyn/compute_v1.imageFamilyViews.html
+++ b/docs/dyn/compute_v1.imageFamilyViews.html
@@ -123,10 +123,10 @@
     ],
     &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
     &quot;imageEncryptionKey&quot;: { # Encrypts the image using a customer-supplied encryption key. After you encrypt an image with a customer-supplied key, you must provide the same key if you use the image later (e.g. to create a disk from the image). Customer-supplied encryption keys do not protect access to metadata of the disk. If you do not provide an encryption key when creating the image, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the image later.
-      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
       &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
     },
     &quot;kind&quot;: &quot;compute#image&quot;, # [Output Only] Type of the resource. Always compute#image for images.
@@ -174,28 +174,28 @@
     },
     &quot;sourceDisk&quot;: &quot;A String&quot;, # URL of the source disk used to create this image. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /disks/disk - projects/project/zones/zone/disks/disk - zones/zone/disks/disk In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
     &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
       &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
     },
     &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
     &quot;sourceImage&quot;: &quot;A String&quot;, # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
     &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
       &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
     },
     &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
     &quot;sourceSnapshot&quot;: &quot;A String&quot;, # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
     &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
       &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
     },
     &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the snapshot used to create this image. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given snapshot name.
diff --git a/docs/dyn/compute_v1.images.html b/docs/dyn/compute_v1.images.html
index 82c0899..0377987 100644
--- a/docs/dyn/compute_v1.images.html
+++ b/docs/dyn/compute_v1.images.html
@@ -291,10 +291,10 @@
   ],
   &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
   &quot;imageEncryptionKey&quot;: { # Encrypts the image using a customer-supplied encryption key. After you encrypt an image with a customer-supplied key, you must provide the same key if you use the image later (e.g. to create a disk from the image). Customer-supplied encryption keys do not protect access to metadata of the disk. If you do not provide an encryption key when creating the image, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the image later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;kind&quot;: &quot;compute#image&quot;, # [Output Only] Type of the resource. Always compute#image for images.
@@ -342,28 +342,28 @@
   },
   &quot;sourceDisk&quot;: &quot;A String&quot;, # URL of the source disk used to create this image. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /disks/disk - projects/project/zones/zone/disks/disk - zones/zone/disks/disk In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
   &quot;sourceImage&quot;: &quot;A String&quot;, # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
   &quot;sourceSnapshot&quot;: &quot;A String&quot;, # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the snapshot used to create this image. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given snapshot name.
@@ -410,10 +410,10 @@
   ],
   &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
   &quot;imageEncryptionKey&quot;: { # Encrypts the image using a customer-supplied encryption key. After you encrypt an image with a customer-supplied key, you must provide the same key if you use the image later (e.g. to create a disk from the image). Customer-supplied encryption keys do not protect access to metadata of the disk. If you do not provide an encryption key when creating the image, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the image later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;kind&quot;: &quot;compute#image&quot;, # [Output Only] Type of the resource. Always compute#image for images.
@@ -461,28 +461,28 @@
   },
   &quot;sourceDisk&quot;: &quot;A String&quot;, # URL of the source disk used to create this image. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /disks/disk - projects/project/zones/zone/disks/disk - zones/zone/disks/disk In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
   &quot;sourceImage&quot;: &quot;A String&quot;, # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
   &quot;sourceSnapshot&quot;: &quot;A String&quot;, # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the snapshot used to create this image. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given snapshot name.
@@ -627,10 +627,10 @@
   ],
   &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
   &quot;imageEncryptionKey&quot;: { # Encrypts the image using a customer-supplied encryption key. After you encrypt an image with a customer-supplied key, you must provide the same key if you use the image later (e.g. to create a disk from the image). Customer-supplied encryption keys do not protect access to metadata of the disk. If you do not provide an encryption key when creating the image, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the image later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;kind&quot;: &quot;compute#image&quot;, # [Output Only] Type of the resource. Always compute#image for images.
@@ -678,28 +678,28 @@
   },
   &quot;sourceDisk&quot;: &quot;A String&quot;, # URL of the source disk used to create this image. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /disks/disk - projects/project/zones/zone/disks/disk - zones/zone/disks/disk In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
   &quot;sourceImage&quot;: &quot;A String&quot;, # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
   &quot;sourceSnapshot&quot;: &quot;A String&quot;, # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the snapshot used to create this image. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given snapshot name.
@@ -809,10 +809,10 @@
       ],
       &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
       &quot;imageEncryptionKey&quot;: { # Encrypts the image using a customer-supplied encryption key. After you encrypt an image with a customer-supplied key, you must provide the same key if you use the image later (e.g. to create a disk from the image). Customer-supplied encryption keys do not protect access to metadata of the disk. If you do not provide an encryption key when creating the image, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the image later.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;kind&quot;: &quot;compute#image&quot;, # [Output Only] Type of the resource. Always compute#image for images.
@@ -860,28 +860,28 @@
       },
       &quot;sourceDisk&quot;: &quot;A String&quot;, # URL of the source disk used to create this image. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /disks/disk - projects/project/zones/zone/disks/disk - zones/zone/disks/disk In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
       &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
       &quot;sourceImage&quot;: &quot;A String&quot;, # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
       &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
       &quot;sourceSnapshot&quot;: &quot;A String&quot;, # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
       &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the snapshot used to create this image. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given snapshot name.
@@ -952,10 +952,10 @@
   ],
   &quot;id&quot;: &quot;A String&quot;, # [Output Only] The unique identifier for the resource. This identifier is defined by the server.
   &quot;imageEncryptionKey&quot;: { # Encrypts the image using a customer-supplied encryption key. After you encrypt an image with a customer-supplied key, you must provide the same key if you use the image later (e.g. to create a disk from the image). Customer-supplied encryption keys do not protect access to metadata of the disk. If you do not provide an encryption key when creating the image, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the image later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;kind&quot;: &quot;compute#image&quot;, # [Output Only] Type of the resource. Always compute#image for images.
@@ -1003,28 +1003,28 @@
   },
   &quot;sourceDisk&quot;: &quot;A String&quot;, # URL of the source disk used to create this image. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/zones/zone /disks/disk - projects/project/zones/zone/disks/disk - zones/zone/disks/disk In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given disk name.
   &quot;sourceImage&quot;: &quot;A String&quot;, # URL of the source image used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ images/image_name - projects/project_id/global/images/image_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this image. This value may be used to determine whether the image was taken from the current or a previous instance of a given image name.
   &quot;sourceSnapshot&quot;: &quot;A String&quot;, # URL of the source snapshot used to create this image. The following are valid formats for the URL: - https://www.googleapis.com/compute/v1/projects/project_id/global/ snapshots/snapshot_name - projects/project_id/global/snapshots/snapshot_name In order to create an image, you must provide the full or partial URL of one of the following: - The rawDisk.source URL - The sourceDisk URL - The sourceImage URL - The sourceSnapshot URL
   &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the snapshot used to create this image. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given snapshot name.
diff --git a/docs/dyn/compute_v1.instanceGroupManagers.html b/docs/dyn/compute_v1.instanceGroupManagers.html
index 6cd356b..dfb8c1a 100644
--- a/docs/dyn/compute_v1.instanceGroupManagers.html
+++ b/docs/dyn/compute_v1.instanceGroupManagers.html
@@ -133,7 +133,7 @@
 <p class="firstline">Retrieves the next page of results.</p>
 <p class="toc_element">
   <code><a href="#patch">patch(project, zone, instanceGroupManager, body=None, requestId=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is patched even if the instances in the group are still in the process of being patched. You must separately verify the status of the individual instances with the listManagedInstances method. This method supports PATCH semantics and uses the JSON merge patch format and processing rules.</p>
+<p class="firstline">Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is patched even if the instances in the group are still in the process of being patched. You must separately verify the status of the individual instances with the listManagedInstances method. This method supports PATCH semantics and uses the JSON merge patch format and processing rules. If you update your group to specify a new template or instance configuration, it's possible that your intended specification for each VM in the group is different from the current state of that VM. To learn how to apply an updated configuration to the VMs in a MIG, see Updating instances in a MIG.</p>
 <p class="toc_element">
   <code><a href="#patchPerInstanceConfigs">patchPerInstanceConfigs(project, zone, instanceGroupManager, body=None, requestId=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Inserts or patches per-instance configs for the managed instance group. perInstanceConfig.name serves as a key used to distinguish whether to perform insert or patch.</p>
@@ -1428,7 +1428,7 @@
 
 <div class="method">
     <code class="details" id="patch">patch(project, zone, instanceGroupManager, body=None, requestId=None, x__xgafv=None)</code>
-  <pre>Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is patched even if the instances in the group are still in the process of being patched. You must separately verify the status of the individual instances with the listManagedInstances method. This method supports PATCH semantics and uses the JSON merge patch format and processing rules.
+  <pre>Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is patched even if the instances in the group are still in the process of being patched. You must separately verify the status of the individual instances with the listManagedInstances method. This method supports PATCH semantics and uses the JSON merge patch format and processing rules. If you update your group to specify a new template or instance configuration, it&#x27;s possible that your intended specification for each VM in the group is different from the current state of that VM. To learn how to apply an updated configuration to the VMs in a MIG, see Updating instances in a MIG.
 
 Args:
   project: string, Project ID for this request. (required)
diff --git a/docs/dyn/compute_v1.instanceTemplates.html b/docs/dyn/compute_v1.instanceTemplates.html
index 52b838f..bf76bb2 100644
--- a/docs/dyn/compute_v1.instanceTemplates.html
+++ b/docs/dyn/compute_v1.instanceTemplates.html
@@ -207,10 +207,10 @@
         &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
         &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
         &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -235,18 +235,18 @@
           ],
           &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
           &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
           &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
         },
@@ -549,10 +549,10 @@
         &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
         &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
         &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -577,18 +577,18 @@
           ],
           &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
           &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
           &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
         },
@@ -855,10 +855,10 @@
             &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
             &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
             &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-              &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-              &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-              &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-              &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+              &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+              &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+              &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+              &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
               &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
             },
             &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -883,18 +883,18 @@
               ],
               &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
               &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-                &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-                &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-                &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-                &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+                &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+                &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+                &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+                &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
                 &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
               },
               &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
               &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-                &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-                &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-                &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-                &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+                &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+                &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+                &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+                &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
                 &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
               },
             },
diff --git a/docs/dyn/compute_v1.instances.html b/docs/dyn/compute_v1.instances.html
index d2e3361..cebcdff 100644
--- a/docs/dyn/compute_v1.instances.html
+++ b/docs/dyn/compute_v1.instances.html
@@ -82,7 +82,7 @@
 <p class="firstline">Adds existing resource policies to an instance. You can only add one policy right now which will be applied to this instance for scheduling live migrations.</p>
 <p class="toc_element">
   <code><a href="#aggregatedList">aggregatedList(project, filter=None, includeAllScopes=None, maxResults=None, orderBy=None, pageToken=None, returnPartialSuccess=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Retrieves aggregated list of all of the instances in your project across all regions and zones.</p>
+<p class="firstline">Retrieves an aggregated list of all of the instances in your project across all regions and zones. The performance of this method degrades when a filter is specified on a project that has a very large number of instances.</p>
 <p class="toc_element">
   <code><a href="#aggregatedList_next">aggregatedList_next(previous_request, previous_response)</a></code></p>
 <p class="firstline">Retrieves the next page of results.</p>
@@ -371,7 +371,7 @@
 
 <div class="method">
     <code class="details" id="aggregatedList">aggregatedList(project, filter=None, includeAllScopes=None, maxResults=None, orderBy=None, pageToken=None, returnPartialSuccess=None, x__xgafv=None)</code>
-  <pre>Retrieves aggregated list of all of the instances in your project across all regions and zones.
+  <pre>Retrieves an aggregated list of all of the instances in your project across all regions and zones. The performance of this method degrades when a filter is specified on a project that has a very large number of instances.
 
 Args:
   project: string, Project ID for this request. (required)
@@ -413,10 +413,10 @@
               &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
               &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
               &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-                &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-                &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-                &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-                &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+                &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+                &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+                &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+                &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
                 &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
               },
               &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -441,18 +441,18 @@
                 ],
                 &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
                 &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-                  &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-                  &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-                  &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-                  &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+                  &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+                  &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+                  &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+                  &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
                   &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
                 },
                 &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
                 &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-                  &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-                  &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-                  &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-                  &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+                  &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+                  &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+                  &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+                  &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
                   &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
                 },
               },
@@ -688,10 +688,10 @@
   &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
   &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
   &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -716,18 +716,18 @@
     ],
     &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
     &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
       &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
     },
     &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
     &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+      &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+      &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+      &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+      &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
       &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
     },
   },
@@ -850,10 +850,10 @@
         &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
         &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
         &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -878,18 +878,18 @@
           ],
           &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
           &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
           &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
         },
@@ -1350,10 +1350,10 @@
       &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
       &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
       &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -1378,18 +1378,18 @@
         ],
         &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
         &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
         &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
       },
@@ -1656,7 +1656,7 @@
         &quot;enable&quot;: True or False, # This field denotes whether to enable logging for a particular firewall rule.
         &quot;metadata&quot;: &quot;A String&quot;, # This field can only be specified for a particular firewall rule if logging is enabled for that rule. This field denotes whether to include or exclude metadata for firewall logs.
       },
-      &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+      &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
       &quot;network&quot;: &quot;A String&quot;, # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
       &quot;priority&quot;: 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
@@ -1928,10 +1928,10 @@
       &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
       &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
       &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -1956,18 +1956,18 @@
         ],
         &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
         &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
         &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
       },
@@ -2241,10 +2241,10 @@
           &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
           &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
           &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -2269,18 +2269,18 @@
             ],
             &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
             &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-              &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-              &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-              &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-              &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+              &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+              &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+              &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+              &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
               &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
             },
             &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
             &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-              &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-              &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-              &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-              &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+              &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+              &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+              &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+              &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
               &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
             },
           },
@@ -3856,13 +3856,13 @@
   &quot;disks&quot;: [ # Array of disks associated with this instance that are protected with a customer-supplied encryption key. In order to start the instance, the disk url and its corresponding key must be provided. If the disk is not protected with a customer-supplied encryption key it should not be specified.
     {
       &quot;diskEncryptionKey&quot;: { # Decrypts data associated with the disk with a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
-      &quot;source&quot;: &quot;A String&quot;, # Specifies a valid partial or full URL to an existing Persistent Disk resource. This field is only applicable for persistent disks.
+      &quot;source&quot;: &quot;A String&quot;, # Specifies a valid partial or full URL to an existing Persistent Disk resource. This field is only applicable for persistent disks. For example: &quot;source&quot;: &quot;/compute/v1/projects/project_id/zones/zone/disks/ disk_name
     },
   ],
 }
@@ -4049,10 +4049,10 @@
       &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
       &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
       &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -4077,18 +4077,18 @@
         ],
         &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
         &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
         &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
       },
diff --git a/docs/dyn/compute_v1.interconnectAttachments.html b/docs/dyn/compute_v1.interconnectAttachments.html
index 9e6b001..b7d7d46 100644
--- a/docs/dyn/compute_v1.interconnectAttachments.html
+++ b/docs/dyn/compute_v1.interconnectAttachments.html
@@ -162,6 +162,7 @@
           },
           &quot;region&quot;: &quot;A String&quot;, # [Output Only] URL of the region where the regional interconnect attachment resides. You must specify this field as part of the HTTP request URL. It is not settable as a field in the request body.
           &quot;router&quot;: &quot;A String&quot;, # URL of the Cloud Router to be used for dynamic routing. This router must be in the same region as this InterconnectAttachment. The InterconnectAttachment will automatically connect the Interconnect to the network &amp; region within which the Cloud Router is configured.
+          &quot;satisfiesPzs&quot;: True or False, # [Output Only] Set to true if the resource satisfies the zone separation organization policy constraints and false otherwise. Defaults to false if the field is not present.
           &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
           &quot;state&quot;: &quot;A String&quot;, # [Output Only] The current state of this attachment&#x27;s functionality. Enum values ACTIVE and UNPROVISIONED are shared by DEDICATED/PRIVATE, PARTNER, and PARTNER_PROVIDER interconnect attachments, while enum values PENDING_PARTNER, PARTNER_REQUEST_RECEIVED, and PENDING_CUSTOMER are used for only PARTNER and PARTNER_PROVIDER interconnect attachments. This state can take one of the following values: - ACTIVE: The attachment has been turned up and is ready to use. - UNPROVISIONED: The attachment is not ready to use yet, because turnup is not complete. - PENDING_PARTNER: A newly-created PARTNER attachment that has not yet been configured on the Partner side. - PARTNER_REQUEST_RECEIVED: A PARTNER attachment is in the process of provisioning after a PARTNER_PROVIDER attachment was created that references it. - PENDING_CUSTOMER: A PARTNER or PARTNER_PROVIDER attachment that is waiting for a customer to activate it. - DEFUNCT: The attachment was deleted externally and is no longer functional. This could be because the associated Interconnect was removed, or because the other side of a Partner attachment was deleted.
           &quot;type&quot;: &quot;A String&quot;, # The type of interconnect attachment this is, which can take one of the following values: - DEDICATED: an attachment to a Dedicated Interconnect. - PARTNER: an attachment to a Partner Interconnect, created by the customer. - PARTNER_PROVIDER: an attachment to a Partner Interconnect, created by the partner.
@@ -333,6 +334,7 @@
   },
   &quot;region&quot;: &quot;A String&quot;, # [Output Only] URL of the region where the regional interconnect attachment resides. You must specify this field as part of the HTTP request URL. It is not settable as a field in the request body.
   &quot;router&quot;: &quot;A String&quot;, # URL of the Cloud Router to be used for dynamic routing. This router must be in the same region as this InterconnectAttachment. The InterconnectAttachment will automatically connect the Interconnect to the network &amp; region within which the Cloud Router is configured.
+  &quot;satisfiesPzs&quot;: True or False, # [Output Only] Set to true if the resource satisfies the zone separation organization policy constraints and false otherwise. Defaults to false if the field is not present.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;state&quot;: &quot;A String&quot;, # [Output Only] The current state of this attachment&#x27;s functionality. Enum values ACTIVE and UNPROVISIONED are shared by DEDICATED/PRIVATE, PARTNER, and PARTNER_PROVIDER interconnect attachments, while enum values PENDING_PARTNER, PARTNER_REQUEST_RECEIVED, and PENDING_CUSTOMER are used for only PARTNER and PARTNER_PROVIDER interconnect attachments. This state can take one of the following values: - ACTIVE: The attachment has been turned up and is ready to use. - UNPROVISIONED: The attachment is not ready to use yet, because turnup is not complete. - PENDING_PARTNER: A newly-created PARTNER attachment that has not yet been configured on the Partner side. - PARTNER_REQUEST_RECEIVED: A PARTNER attachment is in the process of provisioning after a PARTNER_PROVIDER attachment was created that references it. - PENDING_CUSTOMER: A PARTNER or PARTNER_PROVIDER attachment that is waiting for a customer to activate it. - DEFUNCT: The attachment was deleted externally and is no longer functional. This could be because the associated Interconnect was removed, or because the other side of a Partner attachment was deleted.
   &quot;type&quot;: &quot;A String&quot;, # The type of interconnect attachment this is, which can take one of the following values: - DEDICATED: an attachment to a Dedicated Interconnect. - PARTNER: an attachment to a Partner Interconnect, created by the customer. - PARTNER_PROVIDER: an attachment to a Partner Interconnect, created by the partner.
@@ -385,6 +387,7 @@
   },
   &quot;region&quot;: &quot;A String&quot;, # [Output Only] URL of the region where the regional interconnect attachment resides. You must specify this field as part of the HTTP request URL. It is not settable as a field in the request body.
   &quot;router&quot;: &quot;A String&quot;, # URL of the Cloud Router to be used for dynamic routing. This router must be in the same region as this InterconnectAttachment. The InterconnectAttachment will automatically connect the Interconnect to the network &amp; region within which the Cloud Router is configured.
+  &quot;satisfiesPzs&quot;: True or False, # [Output Only] Set to true if the resource satisfies the zone separation organization policy constraints and false otherwise. Defaults to false if the field is not present.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;state&quot;: &quot;A String&quot;, # [Output Only] The current state of this attachment&#x27;s functionality. Enum values ACTIVE and UNPROVISIONED are shared by DEDICATED/PRIVATE, PARTNER, and PARTNER_PROVIDER interconnect attachments, while enum values PENDING_PARTNER, PARTNER_REQUEST_RECEIVED, and PENDING_CUSTOMER are used for only PARTNER and PARTNER_PROVIDER interconnect attachments. This state can take one of the following values: - ACTIVE: The attachment has been turned up and is ready to use. - UNPROVISIONED: The attachment is not ready to use yet, because turnup is not complete. - PENDING_PARTNER: A newly-created PARTNER attachment that has not yet been configured on the Partner side. - PARTNER_REQUEST_RECEIVED: A PARTNER attachment is in the process of provisioning after a PARTNER_PROVIDER attachment was created that references it. - PENDING_CUSTOMER: A PARTNER or PARTNER_PROVIDER attachment that is waiting for a customer to activate it. - DEFUNCT: The attachment was deleted externally and is no longer functional. This could be because the associated Interconnect was removed, or because the other side of a Partner attachment was deleted.
   &quot;type&quot;: &quot;A String&quot;, # The type of interconnect attachment this is, which can take one of the following values: - DEDICATED: an attachment to a Dedicated Interconnect. - PARTNER: an attachment to a Partner Interconnect, created by the customer. - PARTNER_PROVIDER: an attachment to a Partner Interconnect, created by the partner.
@@ -506,6 +509,7 @@
       },
       &quot;region&quot;: &quot;A String&quot;, # [Output Only] URL of the region where the regional interconnect attachment resides. You must specify this field as part of the HTTP request URL. It is not settable as a field in the request body.
       &quot;router&quot;: &quot;A String&quot;, # URL of the Cloud Router to be used for dynamic routing. This router must be in the same region as this InterconnectAttachment. The InterconnectAttachment will automatically connect the Interconnect to the network &amp; region within which the Cloud Router is configured.
+      &quot;satisfiesPzs&quot;: True or False, # [Output Only] Set to true if the resource satisfies the zone separation organization policy constraints and false otherwise. Defaults to false if the field is not present.
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
       &quot;state&quot;: &quot;A String&quot;, # [Output Only] The current state of this attachment&#x27;s functionality. Enum values ACTIVE and UNPROVISIONED are shared by DEDICATED/PRIVATE, PARTNER, and PARTNER_PROVIDER interconnect attachments, while enum values PENDING_PARTNER, PARTNER_REQUEST_RECEIVED, and PENDING_CUSTOMER are used for only PARTNER and PARTNER_PROVIDER interconnect attachments. This state can take one of the following values: - ACTIVE: The attachment has been turned up and is ready to use. - UNPROVISIONED: The attachment is not ready to use yet, because turnup is not complete. - PENDING_PARTNER: A newly-created PARTNER attachment that has not yet been configured on the Partner side. - PARTNER_REQUEST_RECEIVED: A PARTNER attachment is in the process of provisioning after a PARTNER_PROVIDER attachment was created that references it. - PENDING_CUSTOMER: A PARTNER or PARTNER_PROVIDER attachment that is waiting for a customer to activate it. - DEFUNCT: The attachment was deleted externally and is no longer functional. This could be because the associated Interconnect was removed, or because the other side of a Partner attachment was deleted.
       &quot;type&quot;: &quot;A String&quot;, # The type of interconnect attachment this is, which can take one of the following values: - DEDICATED: an attachment to a Dedicated Interconnect. - PARTNER: an attachment to a Partner Interconnect, created by the customer. - PARTNER_PROVIDER: an attachment to a Partner Interconnect, created by the partner.
@@ -588,6 +592,7 @@
   },
   &quot;region&quot;: &quot;A String&quot;, # [Output Only] URL of the region where the regional interconnect attachment resides. You must specify this field as part of the HTTP request URL. It is not settable as a field in the request body.
   &quot;router&quot;: &quot;A String&quot;, # URL of the Cloud Router to be used for dynamic routing. This router must be in the same region as this InterconnectAttachment. The InterconnectAttachment will automatically connect the Interconnect to the network &amp; region within which the Cloud Router is configured.
+  &quot;satisfiesPzs&quot;: True or False, # [Output Only] Set to true if the resource satisfies the zone separation organization policy constraints and false otherwise. Defaults to false if the field is not present.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;state&quot;: &quot;A String&quot;, # [Output Only] The current state of this attachment&#x27;s functionality. Enum values ACTIVE and UNPROVISIONED are shared by DEDICATED/PRIVATE, PARTNER, and PARTNER_PROVIDER interconnect attachments, while enum values PENDING_PARTNER, PARTNER_REQUEST_RECEIVED, and PENDING_CUSTOMER are used for only PARTNER and PARTNER_PROVIDER interconnect attachments. This state can take one of the following values: - ACTIVE: The attachment has been turned up and is ready to use. - UNPROVISIONED: The attachment is not ready to use yet, because turnup is not complete. - PENDING_PARTNER: A newly-created PARTNER attachment that has not yet been configured on the Partner side. - PARTNER_REQUEST_RECEIVED: A PARTNER attachment is in the process of provisioning after a PARTNER_PROVIDER attachment was created that references it. - PENDING_CUSTOMER: A PARTNER or PARTNER_PROVIDER attachment that is waiting for a customer to activate it. - DEFUNCT: The attachment was deleted externally and is no longer functional. This could be because the associated Interconnect was removed, or because the other side of a Partner attachment was deleted.
   &quot;type&quot;: &quot;A String&quot;, # The type of interconnect attachment this is, which can take one of the following values: - DEDICATED: an attachment to a Dedicated Interconnect. - PARTNER: an attachment to a Partner Interconnect, created by the customer. - PARTNER_PROVIDER: an attachment to a Partner Interconnect, created by the partner.
diff --git a/docs/dyn/compute_v1.interconnectLocations.html b/docs/dyn/compute_v1.interconnectLocations.html
index d9bd8a3..bbe15d0 100644
--- a/docs/dyn/compute_v1.interconnectLocations.html
+++ b/docs/dyn/compute_v1.interconnectLocations.html
@@ -129,6 +129,7 @@
   ],
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;status&quot;: &quot;A String&quot;, # [Output Only] The status of this InterconnectLocation, which can take one of the following values: - CLOSED: The InterconnectLocation is closed and is unavailable for provisioning new Interconnects. - AVAILABLE: The InterconnectLocation is available for provisioning new Interconnects.
+  &quot;supportsPzs&quot;: True or False, # [Output Only] Set to true for locations that support physical zone separation. Defaults to false if the field is not present.
 }</pre>
 </div>
 
@@ -176,6 +177,7 @@
       ],
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
       &quot;status&quot;: &quot;A String&quot;, # [Output Only] The status of this InterconnectLocation, which can take one of the following values: - CLOSED: The InterconnectLocation is closed and is unavailable for provisioning new Interconnects. - AVAILABLE: The InterconnectLocation is available for provisioning new Interconnects.
+      &quot;supportsPzs&quot;: True or False, # [Output Only] Set to true for locations that support physical zone separation. Defaults to false if the field is not present.
     },
   ],
   &quot;kind&quot;: &quot;compute#interconnectLocationList&quot;, # [Output Only] Type of resource. Always compute#interconnectLocationList for lists of interconnect locations.
diff --git a/docs/dyn/compute_v1.interconnects.html b/docs/dyn/compute_v1.interconnects.html
index e5150f7..794e592 100644
--- a/docs/dyn/compute_v1.interconnects.html
+++ b/docs/dyn/compute_v1.interconnects.html
@@ -224,6 +224,7 @@
   &quot;peerIpAddress&quot;: &quot;A String&quot;, # [Output Only] IP address configured on the customer side of the Interconnect link. The customer should configure this IP address during turnup when prompted by Google NOC. This can be used only for ping tests.
   &quot;provisionedLinkCount&quot;: 42, # [Output Only] Number of links actually provisioned in this interconnect.
   &quot;requestedLinkCount&quot;: 42, # Target number of physical links in the link bundle, as requested by the customer.
+  &quot;satisfiesPzs&quot;: True or False, # [Output Only] Set to true if the resource satisfies the zone separation organization policy constraints and false otherwise. Defaults to false if the field is not present.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;state&quot;: &quot;A String&quot;, # [Output Only] The current state of Interconnect functionality, which can take one of the following values: - ACTIVE: The Interconnect is valid, turned up and ready to use. Attachments may be provisioned on this Interconnect. - UNPROVISIONED: The Interconnect has not completed turnup. No attachments may be provisioned on this Interconnect. - UNDER_MAINTENANCE: The Interconnect is undergoing internal maintenance. No attachments may be provisioned or updated on this Interconnect.
 }</pre>
@@ -333,6 +334,7 @@
   &quot;peerIpAddress&quot;: &quot;A String&quot;, # [Output Only] IP address configured on the customer side of the Interconnect link. The customer should configure this IP address during turnup when prompted by Google NOC. This can be used only for ping tests.
   &quot;provisionedLinkCount&quot;: 42, # [Output Only] Number of links actually provisioned in this interconnect.
   &quot;requestedLinkCount&quot;: 42, # Target number of physical links in the link bundle, as requested by the customer.
+  &quot;satisfiesPzs&quot;: True or False, # [Output Only] Set to true if the resource satisfies the zone separation organization policy constraints and false otherwise. Defaults to false if the field is not present.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;state&quot;: &quot;A String&quot;, # [Output Only] The current state of Interconnect functionality, which can take one of the following values: - ACTIVE: The Interconnect is valid, turned up and ready to use. Attachments may be provisioned on this Interconnect. - UNPROVISIONED: The Interconnect has not completed turnup. No attachments may be provisioned on this Interconnect. - UNDER_MAINTENANCE: The Interconnect is undergoing internal maintenance. No attachments may be provisioned or updated on this Interconnect.
 }
@@ -457,6 +459,7 @@
       &quot;peerIpAddress&quot;: &quot;A String&quot;, # [Output Only] IP address configured on the customer side of the Interconnect link. The customer should configure this IP address during turnup when prompted by Google NOC. This can be used only for ping tests.
       &quot;provisionedLinkCount&quot;: 42, # [Output Only] Number of links actually provisioned in this interconnect.
       &quot;requestedLinkCount&quot;: 42, # Target number of physical links in the link bundle, as requested by the customer.
+      &quot;satisfiesPzs&quot;: True or False, # [Output Only] Set to true if the resource satisfies the zone separation organization policy constraints and false otherwise. Defaults to false if the field is not present.
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
       &quot;state&quot;: &quot;A String&quot;, # [Output Only] The current state of Interconnect functionality, which can take one of the following values: - ACTIVE: The Interconnect is valid, turned up and ready to use. Attachments may be provisioned on this Interconnect. - UNPROVISIONED: The Interconnect has not completed turnup. No attachments may be provisioned on this Interconnect. - UNDER_MAINTENANCE: The Interconnect is undergoing internal maintenance. No attachments may be provisioned or updated on this Interconnect.
     },
@@ -543,6 +546,7 @@
   &quot;peerIpAddress&quot;: &quot;A String&quot;, # [Output Only] IP address configured on the customer side of the Interconnect link. The customer should configure this IP address during turnup when prompted by Google NOC. This can be used only for ping tests.
   &quot;provisionedLinkCount&quot;: 42, # [Output Only] Number of links actually provisioned in this interconnect.
   &quot;requestedLinkCount&quot;: 42, # Target number of physical links in the link bundle, as requested by the customer.
+  &quot;satisfiesPzs&quot;: True or False, # [Output Only] Set to true if the resource satisfies the zone separation organization policy constraints and false otherwise. Defaults to false if the field is not present.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;state&quot;: &quot;A String&quot;, # [Output Only] The current state of Interconnect functionality, which can take one of the following values: - ACTIVE: The Interconnect is valid, turned up and ready to use. Attachments may be provisioned on this Interconnect. - UNPROVISIONED: The Interconnect has not completed turnup. No attachments may be provisioned on this Interconnect. - UNDER_MAINTENANCE: The Interconnect is undergoing internal maintenance. No attachments may be provisioned or updated on this Interconnect.
 }
diff --git a/docs/dyn/compute_v1.networks.html b/docs/dyn/compute_v1.networks.html
index 2fbbd2e..0709dae 100644
--- a/docs/dyn/compute_v1.networks.html
+++ b/docs/dyn/compute_v1.networks.html
@@ -409,7 +409,7 @@
         &quot;enable&quot;: True or False, # This field denotes whether to enable logging for a particular firewall rule.
         &quot;metadata&quot;: &quot;A String&quot;, # This field can only be specified for a particular firewall rule if logging is enabled for that rule. This field denotes whether to include or exclude metadata for firewall logs.
       },
-      &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
+      &quot;name&quot;: &quot;A String&quot;, # Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit.
       &quot;network&quot;: &quot;A String&quot;, # URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
       &quot;priority&quot;: 42, # Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
diff --git a/docs/dyn/compute_v1.regionBackendServices.html b/docs/dyn/compute_v1.regionBackendServices.html
index b3cf1fc..369c789 100644
--- a/docs/dyn/compute_v1.regionBackendServices.html
+++ b/docs/dyn/compute_v1.regionBackendServices.html
@@ -332,6 +332,9 @@
   },
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;sessionAffinity&quot;: &quot;A String&quot;, # Type of session affinity to use. The default is NONE. For a detailed description of session affinity options, see: [Session affinity](https://cloud.google.com/load-balancing/docs/backend-service#session_affinity). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
+  &quot;subsetting&quot;: { # Subsetting configuration for this BackendService. Currently this is applicable only for Internal TCP/UDP load balancing, Internal HTTP(S) load balancing and Traffic Director.
+    &quot;policy&quot;: &quot;A String&quot;,
+  },
   &quot;timeoutSec&quot;: 42, # Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true. Instead, use maxStreamDuration.
 }</pre>
 </div>
@@ -537,6 +540,9 @@
   },
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;sessionAffinity&quot;: &quot;A String&quot;, # Type of session affinity to use. The default is NONE. For a detailed description of session affinity options, see: [Session affinity](https://cloud.google.com/load-balancing/docs/backend-service#session_affinity). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
+  &quot;subsetting&quot;: { # Subsetting configuration for this BackendService. Currently this is applicable only for Internal TCP/UDP load balancing, Internal HTTP(S) load balancing and Traffic Director.
+    &quot;policy&quot;: &quot;A String&quot;,
+  },
   &quot;timeoutSec&quot;: 42, # Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true. Instead, use maxStreamDuration.
 }
 
@@ -764,6 +770,9 @@
       },
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
       &quot;sessionAffinity&quot;: &quot;A String&quot;, # Type of session affinity to use. The default is NONE. For a detailed description of session affinity options, see: [Session affinity](https://cloud.google.com/load-balancing/docs/backend-service#session_affinity). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
+      &quot;subsetting&quot;: { # Subsetting configuration for this BackendService. Currently this is applicable only for Internal TCP/UDP load balancing, Internal HTTP(S) load balancing and Traffic Director.
+        &quot;policy&quot;: &quot;A String&quot;,
+      },
       &quot;timeoutSec&quot;: 42, # Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true. Instead, use maxStreamDuration.
     },
   ],
@@ -953,6 +962,9 @@
   },
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;sessionAffinity&quot;: &quot;A String&quot;, # Type of session affinity to use. The default is NONE. For a detailed description of session affinity options, see: [Session affinity](https://cloud.google.com/load-balancing/docs/backend-service#session_affinity). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
+  &quot;subsetting&quot;: { # Subsetting configuration for this BackendService. Currently this is applicable only for Internal TCP/UDP load balancing, Internal HTTP(S) load balancing and Traffic Director.
+    &quot;policy&quot;: &quot;A String&quot;,
+  },
   &quot;timeoutSec&quot;: 42, # Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true. Instead, use maxStreamDuration.
 }
 
@@ -1168,6 +1180,9 @@
   },
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;sessionAffinity&quot;: &quot;A String&quot;, # Type of session affinity to use. The default is NONE. For a detailed description of session affinity options, see: [Session affinity](https://cloud.google.com/load-balancing/docs/backend-service#session_affinity). Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true.
+  &quot;subsetting&quot;: { # Subsetting configuration for this BackendService. Currently this is applicable only for Internal TCP/UDP load balancing, Internal HTTP(S) load balancing and Traffic Director.
+    &quot;policy&quot;: &quot;A String&quot;,
+  },
   &quot;timeoutSec&quot;: 42, # Not supported when the backend service is referenced by a URL map that is bound to target gRPC proxy that has validateForProxyless field set to true. Instead, use maxStreamDuration.
 }
 
diff --git a/docs/dyn/compute_v1.regionDisks.html b/docs/dyn/compute_v1.regionDisks.html
index d40f28c..dc5c970 100644
--- a/docs/dyn/compute_v1.regionDisks.html
+++ b/docs/dyn/compute_v1.regionDisks.html
@@ -230,18 +230,18 @@
   &quot;satisfiesPzs&quot;: True or False, # [Output Only] Reserved for future use.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;snapshotEncryptionKey&quot;: { # Encrypts the snapshot using a customer-supplied encryption key. After you encrypt a snapshot using a customer-supplied key, you must provide the same key if you use the snapshot later. For example, you must provide the encryption key when you create a disk from the encrypted snapshot in a future request. Customer-supplied encryption keys do not protect access to metadata of the snapshot. If you do not provide an encryption key when creating the snapshot, then the snapshot will be encrypted using an automatically generated key and you do not need to provide a key to use the snapshot later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDisk&quot;: &quot;A String&quot;, # The source disk used to create this snapshot.
   &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this snapshot. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given disk name.
@@ -393,10 +393,10 @@
   &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
   &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
   &quot;diskEncryptionKey&quot;: { # Encrypts the disk using a customer-supplied encryption key or a customer-managed encryption key. Encryption keys do not protect access to metadata of the disk. After you encrypt a disk with a customer-supplied key, you must provide the same key if you use the disk later. For example, to create a disk snapshot, to create a disk image, to create a machine image, or to attach the disk to a virtual machine. After you encrypt a disk with a customer-managed key, the diskEncryptionKey.kmsKeyName is set to a key *version* name once the disk is created. The disk is encrypted with this version of the key. In the response, diskEncryptionKey.kmsKeyName appears in the following format: &quot;diskEncryptionKey.kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key /cryptoKeysVersions/version If you do not provide an encryption key when creating the disk, then the disk is encrypted using an automatically generated key and you don&#x27;t need to provide a key to use the disk later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;guestOsFeatures&quot;: [ # A list of features to enable on the guest operating system. Applicable only for bootable images. Read Enabling guest operating system features to see a list of available options.
@@ -437,19 +437,19 @@
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the disk used to create this disk. This value identifies the exact disk that was used to create this persistent disk. For example, if you created the persistent disk from a disk that was later deleted and recreated under the same name, the source disk ID would identify the exact version of the disk that was used.
   &quot;sourceImage&quot;: &quot;A String&quot;, # The source image used to create this disk. If the source image is deleted, this field will not be set. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family
   &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
   &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/snapshots/snapshot - projects/project/global/snapshots/snapshot - global/snapshots/snapshot
   &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.
@@ -582,10 +582,10 @@
   &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
   &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
   &quot;diskEncryptionKey&quot;: { # Encrypts the disk using a customer-supplied encryption key or a customer-managed encryption key. Encryption keys do not protect access to metadata of the disk. After you encrypt a disk with a customer-supplied key, you must provide the same key if you use the disk later. For example, to create a disk snapshot, to create a disk image, to create a machine image, or to attach the disk to a virtual machine. After you encrypt a disk with a customer-managed key, the diskEncryptionKey.kmsKeyName is set to a key *version* name once the disk is created. The disk is encrypted with this version of the key. In the response, diskEncryptionKey.kmsKeyName appears in the following format: &quot;diskEncryptionKey.kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key /cryptoKeysVersions/version If you do not provide an encryption key when creating the disk, then the disk is encrypted using an automatically generated key and you don&#x27;t need to provide a key to use the disk later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;guestOsFeatures&quot;: [ # A list of features to enable on the guest operating system. Applicable only for bootable images. Read Enabling guest operating system features to see a list of available options.
@@ -626,19 +626,19 @@
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the disk used to create this disk. This value identifies the exact disk that was used to create this persistent disk. For example, if you created the persistent disk from a disk that was later deleted and recreated under the same name, the source disk ID would identify the exact version of the disk that was used.
   &quot;sourceImage&quot;: &quot;A String&quot;, # The source image used to create this disk. If the source image is deleted, this field will not be set. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family
   &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
   &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/snapshots/snapshot - projects/project/global/snapshots/snapshot - global/snapshots/snapshot
   &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.
@@ -735,10 +735,10 @@
       &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
       &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this property when you create the resource.
       &quot;diskEncryptionKey&quot;: { # Encrypts the disk using a customer-supplied encryption key or a customer-managed encryption key. Encryption keys do not protect access to metadata of the disk. After you encrypt a disk with a customer-supplied key, you must provide the same key if you use the disk later. For example, to create a disk snapshot, to create a disk image, to create a machine image, or to attach the disk to a virtual machine. After you encrypt a disk with a customer-managed key, the diskEncryptionKey.kmsKeyName is set to a key *version* name once the disk is created. The disk is encrypted with this version of the key. In the response, diskEncryptionKey.kmsKeyName appears in the following format: &quot;diskEncryptionKey.kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key /cryptoKeysVersions/version If you do not provide an encryption key when creating the disk, then the disk is encrypted using an automatically generated key and you don&#x27;t need to provide a key to use the disk later.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;guestOsFeatures&quot;: [ # A list of features to enable on the guest operating system. Applicable only for bootable images. Read Enabling guest operating system features to see a list of available options.
@@ -779,19 +779,19 @@
       &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the disk used to create this disk. This value identifies the exact disk that was used to create this persistent disk. For example, if you created the persistent disk from a disk that was later deleted and recreated under the same name, the source disk ID would identify the exact version of the disk that was used.
       &quot;sourceImage&quot;: &quot;A String&quot;, # The source image used to create this disk. If the source image is deleted, this field will not be set. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family
       &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceImageId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the image used to create this disk. This value identifies the exact image that was used to create this persistent disk. For example, if you created the persistent disk from an image that was later deleted and recreated under the same name, the source image ID would identify the exact version of the image that was used.
       &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot used to create this disk. You can provide this as a partial or full URL to the resource. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project /global/snapshots/snapshot - projects/project/global/snapshots/snapshot - global/snapshots/snapshot
       &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot. Required if the source snapshot is protected by a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceSnapshotId&quot;: &quot;A String&quot;, # [Output Only] The unique ID of the snapshot used to create this disk. This value identifies the exact snapshot that was used to create this persistent disk. For example, if you created the persistent disk from a snapshot that was later deleted and recreated under the same name, the source snapshot ID would identify the exact version of the snapshot that was used.
diff --git a/docs/dyn/compute_v1.regionInstanceGroupManagers.html b/docs/dyn/compute_v1.regionInstanceGroupManagers.html
index 57595e2..08e3959 100644
--- a/docs/dyn/compute_v1.regionInstanceGroupManagers.html
+++ b/docs/dyn/compute_v1.regionInstanceGroupManagers.html
@@ -127,7 +127,7 @@
 <p class="firstline">Retrieves the next page of results.</p>
 <p class="toc_element">
   <code><a href="#patch">patch(project, region, instanceGroupManager, body=None, requestId=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is patched even if the instances in the group are still in the process of being patched. You must separately verify the status of the individual instances with the listmanagedinstances method. This method supports PATCH semantics and uses the JSON merge patch format and processing rules.</p>
+<p class="firstline">Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is patched even if the instances in the group are still in the process of being patched. You must separately verify the status of the individual instances with the listmanagedinstances method. This method supports PATCH semantics and uses the JSON merge patch format and processing rules. If you update your group to specify a new template or instance configuration, it's possible that your intended specification for each VM in the group is different from the current state of that VM. To learn how to apply an updated configuration to the VMs in a MIG, see Updating instances in a MIG.</p>
 <p class="toc_element">
   <code><a href="#patchPerInstanceConfigs">patchPerInstanceConfigs(project, region, instanceGroupManager, body=None, requestId=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Inserts or patches per-instance configs for the managed instance group. perInstanceConfig.name serves as a key used to distinguish whether to perform insert or patch.</p>
@@ -1253,7 +1253,7 @@
 
 <div class="method">
     <code class="details" id="patch">patch(project, region, instanceGroupManager, body=None, requestId=None, x__xgafv=None)</code>
-  <pre>Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is patched even if the instances in the group are still in the process of being patched. You must separately verify the status of the individual instances with the listmanagedinstances method. This method supports PATCH semantics and uses the JSON merge patch format and processing rules.
+  <pre>Updates a managed instance group using the information that you specify in the request. This operation is marked as DONE when the group is patched even if the instances in the group are still in the process of being patched. You must separately verify the status of the individual instances with the listmanagedinstances method. This method supports PATCH semantics and uses the JSON merge patch format and processing rules. If you update your group to specify a new template or instance configuration, it&#x27;s possible that your intended specification for each VM in the group is different from the current state of that VM. To learn how to apply an updated configuration to the VMs in a MIG, see Updating instances in a MIG.
 
 Args:
   project: string, Project ID for this request. (required)
diff --git a/docs/dyn/compute_v1.regionInstances.html b/docs/dyn/compute_v1.regionInstances.html
index b5a0eed..d2d1189 100644
--- a/docs/dyn/compute_v1.regionInstances.html
+++ b/docs/dyn/compute_v1.regionInstances.html
@@ -109,10 +109,10 @@
         &quot;boot&quot;: True or False, # Indicates that this is a boot disk. The virtual machine will use the first partition of the disk for its root filesystem.
         &quot;deviceName&quot;: &quot;A String&quot;, # Specifies a unique device name of your choice that is reflected into the /dev/disk/by-id/google-* tree of a Linux operating system running within the instance. This name can be used to reference the device for mounting, resizing, and so on, from within the instance. If not specified, the server chooses a default device name to apply to this disk, in the form persistent-disk-x, where x is a number assigned by Google Compute Engine. This field is only applicable for persistent disks.
         &quot;diskEncryptionKey&quot;: { # Encrypts or decrypts a disk using a customer-supplied encryption key. If you are creating a new disk, this field encrypts the new disk using an encryption key that you provide. If you are attaching an existing disk that is already encrypted, this field decrypts the disk using the customer-supplied encryption key. If you encrypt a disk using a customer-supplied key, you must provide the same key again when you attempt to use this resource at a later time. For example, you must provide the key when you create a snapshot or an image from the disk or when you attach the disk to a virtual machine instance. If you do not provide an encryption key, then the disk will be encrypted using an automatically generated key and you do not need to provide a key to use the disk later. Instance templates do not store customer-supplied encryption keys, so you cannot use your own keys to encrypt disks in a managed instance group.
-          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+          &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+          &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+          &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+          &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
           &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
         },
         &quot;diskSizeGb&quot;: &quot;A String&quot;, # The size of the disk in GB.
@@ -137,18 +137,18 @@
           ],
           &quot;sourceImage&quot;: &quot;A String&quot;, # The source image to create this disk. When creating a new instance, one of initializeParams.sourceImage or initializeParams.sourceSnapshot or disks.source is required except for local SSD. To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-9 to use the latest Debian 9 image: projects/debian-cloud/global/images/family/debian-9 Alternatively, use a specific version of a public operating system image: projects/debian-cloud/global/images/debian-9-stretch-vYYYYMMDD To create a disk with a custom image that you created, specify the image name in the following format: global/images/my-custom-image You can also specify a custom image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name: global/images/family/my-image-family If the source image is deleted later, this field will not be set.
           &quot;sourceImageEncryptionKey&quot;: { # The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key. Instance templates do not store customer-supplied encryption keys, so you cannot create disks for instances in a managed instance group if the source images are encrypted with your own keys.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
           &quot;sourceSnapshot&quot;: &quot;A String&quot;, # The source snapshot to create this disk. When creating a new instance, one of initializeParams.sourceSnapshot or initializeParams.sourceImage or disks.source is required except for local SSD. To create a disk with a snapshot that you created, specify the snapshot name in the following format: global/snapshots/my-backup If the source snapshot is deleted later, this field will not be set.
           &quot;sourceSnapshotEncryptionKey&quot;: { # The customer-supplied encryption key of the source snapshot.
-            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+            &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+            &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+            &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+            &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
             &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
           },
         },
diff --git a/docs/dyn/compute_v1.routers.html b/docs/dyn/compute_v1.routers.html
index 1400e8c..70d4317 100644
--- a/docs/dyn/compute_v1.routers.html
+++ b/docs/dyn/compute_v1.routers.html
@@ -221,6 +221,21 @@
               &quot;natIps&quot;: [ # A list of URLs of the IP resources used for this Nat service. These IP addresses must be valid static external IP addresses assigned to the project.
                 &quot;A String&quot;,
               ],
+              &quot;rules&quot;: [ # A list of rules associated with this NAT.
+                {
+                  &quot;action&quot;: { # The action to be enforced for traffic that matches this rule.
+                    &quot;sourceNatActiveIps&quot;: [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project. This field is used for public NAT.
+                      &quot;A String&quot;,
+                    ],
+                    &quot;sourceNatDrainIps&quot;: [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only. This field is used for public NAT.
+                      &quot;A String&quot;,
+                    ],
+                  },
+                  &quot;description&quot;: &quot;A String&quot;, # An optional description of this rule.
+                  &quot;match&quot;: &quot;A String&quot;, # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions for public NAT: &quot;inIpRange(destination.ip, &#x27;1.1.0.0/16&#x27;) || inIpRange(destination.ip, &#x27;2.2.0.0/16&#x27;)&quot; &quot;destination.ip == &#x27;1.1.0.1&#x27; || destination.ip == &#x27;8.8.8.8&#x27;&quot; The following example is a valid match expression for private NAT: &quot;nexthop.hub == &#x27;/projects/my-project/global/hub/hub-1&#x27;&quot;
+                  &quot;ruleNumber&quot;: 42, # An integer uniquely identifying a rule in the list. The rule number must be a positive value between 0 and 65000, and must be unique among rules within a NAT.
+                },
+              ],
               &quot;sourceSubnetworkIpRangesToNat&quot;: &quot;A String&quot;, # Specify the Nat option, which can take one of the following values: - ALL_SUBNETWORKS_ALL_IP_RANGES: All of the IP ranges in every Subnetwork are allowed to Nat. - ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES: All of the primary IP ranges in every Subnetwork are allowed to Nat. - LIST_OF_SUBNETWORKS: A list of Subnetworks are allowed to Nat (specified in the field subnetwork below) The default is SUBNETWORK_IP_RANGE_TO_NAT_OPTION_UNSPECIFIED. Note that if this field contains ALL_SUBNETWORKS_ALL_IP_RANGES or ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, then there should not be any other Router.Nat section in any Router for this network in this region.
               &quot;subnetworks&quot;: [ # A list of Subnetwork resources whose traffic should be translated by NAT Gateway. It is used only when LIST_OF_SUBNETWORKS is selected for the SubnetworkIpRangeToNatOption above.
                 { # Defines the IP ranges that want to use NAT for a subnetwork.
@@ -234,6 +249,7 @@
                 },
               ],
               &quot;tcpEstablishedIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP established connections. Defaults to 1200s if not set.
+              &quot;tcpTimeWaitTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP connections that are in TIME_WAIT state. Defaults to 120s if not set.
               &quot;tcpTransitoryIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP transitory connections. Defaults to 30s if not set.
               &quot;udpIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for UDP connections. Defaults to 30s if not set.
             },
@@ -452,6 +468,21 @@
       &quot;natIps&quot;: [ # A list of URLs of the IP resources used for this Nat service. These IP addresses must be valid static external IP addresses assigned to the project.
         &quot;A String&quot;,
       ],
+      &quot;rules&quot;: [ # A list of rules associated with this NAT.
+        {
+          &quot;action&quot;: { # The action to be enforced for traffic that matches this rule.
+            &quot;sourceNatActiveIps&quot;: [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project. This field is used for public NAT.
+              &quot;A String&quot;,
+            ],
+            &quot;sourceNatDrainIps&quot;: [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only. This field is used for public NAT.
+              &quot;A String&quot;,
+            ],
+          },
+          &quot;description&quot;: &quot;A String&quot;, # An optional description of this rule.
+          &quot;match&quot;: &quot;A String&quot;, # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions for public NAT: &quot;inIpRange(destination.ip, &#x27;1.1.0.0/16&#x27;) || inIpRange(destination.ip, &#x27;2.2.0.0/16&#x27;)&quot; &quot;destination.ip == &#x27;1.1.0.1&#x27; || destination.ip == &#x27;8.8.8.8&#x27;&quot; The following example is a valid match expression for private NAT: &quot;nexthop.hub == &#x27;/projects/my-project/global/hub/hub-1&#x27;&quot;
+          &quot;ruleNumber&quot;: 42, # An integer uniquely identifying a rule in the list. The rule number must be a positive value between 0 and 65000, and must be unique among rules within a NAT.
+        },
+      ],
       &quot;sourceSubnetworkIpRangesToNat&quot;: &quot;A String&quot;, # Specify the Nat option, which can take one of the following values: - ALL_SUBNETWORKS_ALL_IP_RANGES: All of the IP ranges in every Subnetwork are allowed to Nat. - ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES: All of the primary IP ranges in every Subnetwork are allowed to Nat. - LIST_OF_SUBNETWORKS: A list of Subnetworks are allowed to Nat (specified in the field subnetwork below) The default is SUBNETWORK_IP_RANGE_TO_NAT_OPTION_UNSPECIFIED. Note that if this field contains ALL_SUBNETWORKS_ALL_IP_RANGES or ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, then there should not be any other Router.Nat section in any Router for this network in this region.
       &quot;subnetworks&quot;: [ # A list of Subnetwork resources whose traffic should be translated by NAT Gateway. It is used only when LIST_OF_SUBNETWORKS is selected for the SubnetworkIpRangeToNatOption above.
         { # Defines the IP ranges that want to use NAT for a subnetwork.
@@ -465,6 +496,7 @@
         },
       ],
       &quot;tcpEstablishedIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP established connections. Defaults to 1200s if not set.
+      &quot;tcpTimeWaitTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP connections that are in TIME_WAIT state. Defaults to 120s if not set.
       &quot;tcpTransitoryIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP transitory connections. Defaults to 30s if not set.
       &quot;udpIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for UDP connections. Defaults to 30s if not set.
     },
@@ -568,6 +600,14 @@
   &quot;result&quot;: {
     &quot;bestRoutes&quot;: [ # Best routes for this router&#x27;s network.
       { # Represents a Route resource. A route defines a path from VM instances in the VPC network to a specific destination. This destination can be inside or outside the VPC network. For more information, read the Routes overview.
+        &quot;asPaths&quot;: [ # [Output Only] AS path.
+          {
+            &quot;asLists&quot;: [ # [Output Only] The AS numbers of the AS Path.
+              42,
+            ],
+            &quot;pathSegmentType&quot;: &quot;A String&quot;, # [Output Only] The type of the AS Path, which can be one of the following values: - &#x27;AS_SET&#x27;: unordered set of autonomous systems that the route in has traversed - &#x27;AS_SEQUENCE&#x27;: ordered set of autonomous systems that the route has traversed - &#x27;AS_CONFED_SEQUENCE&#x27;: ordered set of Member Autonomous Systems in the local confederation that the route has traversed - &#x27;AS_CONFED_SET&#x27;: unordered set of Member Autonomous Systems in the local confederation that the route has traversed
+          },
+        ],
         &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
         &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this field when you create the resource.
         &quot;destRange&quot;: &quot;A String&quot;, # The destination range of outgoing packets that this route applies to. Both IPv4 and IPv6 are supported.
@@ -583,6 +623,7 @@
         &quot;nextHopPeering&quot;: &quot;A String&quot;, # [Output Only] The network peering name that should handle matching packets, which should conform to RFC1035.
         &quot;nextHopVpnTunnel&quot;: &quot;A String&quot;, # The URL to a VpnTunnel that should handle matching packets.
         &quot;priority&quot;: 42, # The priority of this route. Priority is used to break ties in cases where there is more than one matching route of equal prefix length. In cases where multiple routes have equal prefix length, the one with the lowest-numbered priority value wins. The default value is `1000`. The priority value must be from `0` to `65535`, inclusive.
+        &quot;routeType&quot;: &quot;A String&quot;, # [Output Only] The type of this route, which can be one of the following values: - &#x27;TRANSIT&#x27; for a transit route that this router learned from another Cloud Router and will readvertise to one of its BGP peers - &#x27;SUBNET&#x27; for a route from a subnet of the VPC - &#x27;BGP&#x27; for a route learned from a BGP peer of this router - &#x27;STATIC&#x27; for a static route
         &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined fully-qualified URL for this resource.
         &quot;tags&quot;: [ # A list of instance tags to which this route applies.
           &quot;A String&quot;,
@@ -603,6 +644,14 @@
     ],
     &quot;bestRoutesForRouter&quot;: [ # Best routes learned by this router.
       { # Represents a Route resource. A route defines a path from VM instances in the VPC network to a specific destination. This destination can be inside or outside the VPC network. For more information, read the Routes overview.
+        &quot;asPaths&quot;: [ # [Output Only] AS path.
+          {
+            &quot;asLists&quot;: [ # [Output Only] The AS numbers of the AS Path.
+              42,
+            ],
+            &quot;pathSegmentType&quot;: &quot;A String&quot;, # [Output Only] The type of the AS Path, which can be one of the following values: - &#x27;AS_SET&#x27;: unordered set of autonomous systems that the route in has traversed - &#x27;AS_SEQUENCE&#x27;: ordered set of autonomous systems that the route has traversed - &#x27;AS_CONFED_SEQUENCE&#x27;: ordered set of Member Autonomous Systems in the local confederation that the route has traversed - &#x27;AS_CONFED_SET&#x27;: unordered set of Member Autonomous Systems in the local confederation that the route has traversed
+          },
+        ],
         &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
         &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this field when you create the resource.
         &quot;destRange&quot;: &quot;A String&quot;, # The destination range of outgoing packets that this route applies to. Both IPv4 and IPv6 are supported.
@@ -618,6 +667,7 @@
         &quot;nextHopPeering&quot;: &quot;A String&quot;, # [Output Only] The network peering name that should handle matching packets, which should conform to RFC1035.
         &quot;nextHopVpnTunnel&quot;: &quot;A String&quot;, # The URL to a VpnTunnel that should handle matching packets.
         &quot;priority&quot;: 42, # The priority of this route. Priority is used to break ties in cases where there is more than one matching route of equal prefix length. In cases where multiple routes have equal prefix length, the one with the lowest-numbered priority value wins. The default value is `1000`. The priority value must be from `0` to `65535`, inclusive.
+        &quot;routeType&quot;: &quot;A String&quot;, # [Output Only] The type of this route, which can be one of the following values: - &#x27;TRANSIT&#x27; for a transit route that this router learned from another Cloud Router and will readvertise to one of its BGP peers - &#x27;SUBNET&#x27; for a route from a subnet of the VPC - &#x27;BGP&#x27; for a route learned from a BGP peer of this router - &#x27;STATIC&#x27; for a static route
         &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined fully-qualified URL for this resource.
         &quot;tags&quot;: [ # A list of instance tags to which this route applies.
           &quot;A String&quot;,
@@ -640,6 +690,14 @@
       {
         &quot;advertisedRoutes&quot;: [ # Routes that were advertised to the remote BGP peer
           { # Represents a Route resource. A route defines a path from VM instances in the VPC network to a specific destination. This destination can be inside or outside the VPC network. For more information, read the Routes overview.
+            &quot;asPaths&quot;: [ # [Output Only] AS path.
+              {
+                &quot;asLists&quot;: [ # [Output Only] The AS numbers of the AS Path.
+                  42,
+                ],
+                &quot;pathSegmentType&quot;: &quot;A String&quot;, # [Output Only] The type of the AS Path, which can be one of the following values: - &#x27;AS_SET&#x27;: unordered set of autonomous systems that the route in has traversed - &#x27;AS_SEQUENCE&#x27;: ordered set of autonomous systems that the route has traversed - &#x27;AS_CONFED_SEQUENCE&#x27;: ordered set of Member Autonomous Systems in the local confederation that the route has traversed - &#x27;AS_CONFED_SET&#x27;: unordered set of Member Autonomous Systems in the local confederation that the route has traversed
+              },
+            ],
             &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
             &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this field when you create the resource.
             &quot;destRange&quot;: &quot;A String&quot;, # The destination range of outgoing packets that this route applies to. Both IPv4 and IPv6 are supported.
@@ -655,6 +713,7 @@
             &quot;nextHopPeering&quot;: &quot;A String&quot;, # [Output Only] The network peering name that should handle matching packets, which should conform to RFC1035.
             &quot;nextHopVpnTunnel&quot;: &quot;A String&quot;, # The URL to a VpnTunnel that should handle matching packets.
             &quot;priority&quot;: 42, # The priority of this route. Priority is used to break ties in cases where there is more than one matching route of equal prefix length. In cases where multiple routes have equal prefix length, the one with the lowest-numbered priority value wins. The default value is `1000`. The priority value must be from `0` to `65535`, inclusive.
+            &quot;routeType&quot;: &quot;A String&quot;, # [Output Only] The type of this route, which can be one of the following values: - &#x27;TRANSIT&#x27; for a transit route that this router learned from another Cloud Router and will readvertise to one of its BGP peers - &#x27;SUBNET&#x27; for a route from a subnet of the VPC - &#x27;BGP&#x27; for a route learned from a BGP peer of this router - &#x27;STATIC&#x27; for a static route
             &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined fully-qualified URL for this resource.
             &quot;tags&quot;: [ # A list of instance tags to which this route applies.
               &quot;A String&quot;,
@@ -699,6 +758,19 @@
         &quot;minExtraNatIpsNeeded&quot;: 42, # The number of extra IPs to allocate. This will be greater than 0 only if user-specified IPs are NOT enough to allow all configured VMs to use NAT. This value is meaningful only when auto-allocation of NAT IPs is *not* used.
         &quot;name&quot;: &quot;A String&quot;, # Unique name of this NAT.
         &quot;numVmEndpointsWithNatMappings&quot;: 42, # Number of VM endpoints (i.e., Nics) that can use NAT.
+        &quot;ruleStatus&quot;: [ # Status of rules in this NAT.
+          { # Status of a NAT Rule contained in this NAT.
+            &quot;activeNatIps&quot;: [ # A list of active IPs for NAT. Example: [&quot;1.1.1.1&quot;, &quot;179.12.26.133&quot;].
+              &quot;A String&quot;,
+            ],
+            &quot;drainNatIps&quot;: [ # A list of IPs for NAT that are in drain mode. Example: [&quot;1.1.1.1&quot;, &quot;179.12.26.133&quot;].
+              &quot;A String&quot;,
+            ],
+            &quot;minExtraIpsNeeded&quot;: 42, # The number of extra IPs to allocate. This will be greater than 0 only if the existing IPs in this NAT Rule are NOT enough to allow all configured VMs to use NAT.
+            &quot;numVmEndpointsWithNatMappings&quot;: 42, # Number of VM endpoints (i.e., NICs) that have NAT Mappings from this NAT Rule.
+            &quot;ruleNumber&quot;: 42, # Rule number of the rule.
+          },
+        ],
         &quot;userAllocatedNatIpResources&quot;: [ # A list of fully qualified URLs of reserved IP address resources.
           &quot;A String&quot;,
         ],
@@ -801,6 +873,21 @@
       &quot;natIps&quot;: [ # A list of URLs of the IP resources used for this Nat service. These IP addresses must be valid static external IP addresses assigned to the project.
         &quot;A String&quot;,
       ],
+      &quot;rules&quot;: [ # A list of rules associated with this NAT.
+        {
+          &quot;action&quot;: { # The action to be enforced for traffic that matches this rule.
+            &quot;sourceNatActiveIps&quot;: [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project. This field is used for public NAT.
+              &quot;A String&quot;,
+            ],
+            &quot;sourceNatDrainIps&quot;: [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only. This field is used for public NAT.
+              &quot;A String&quot;,
+            ],
+          },
+          &quot;description&quot;: &quot;A String&quot;, # An optional description of this rule.
+          &quot;match&quot;: &quot;A String&quot;, # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions for public NAT: &quot;inIpRange(destination.ip, &#x27;1.1.0.0/16&#x27;) || inIpRange(destination.ip, &#x27;2.2.0.0/16&#x27;)&quot; &quot;destination.ip == &#x27;1.1.0.1&#x27; || destination.ip == &#x27;8.8.8.8&#x27;&quot; The following example is a valid match expression for private NAT: &quot;nexthop.hub == &#x27;/projects/my-project/global/hub/hub-1&#x27;&quot;
+          &quot;ruleNumber&quot;: 42, # An integer uniquely identifying a rule in the list. The rule number must be a positive value between 0 and 65000, and must be unique among rules within a NAT.
+        },
+      ],
       &quot;sourceSubnetworkIpRangesToNat&quot;: &quot;A String&quot;, # Specify the Nat option, which can take one of the following values: - ALL_SUBNETWORKS_ALL_IP_RANGES: All of the IP ranges in every Subnetwork are allowed to Nat. - ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES: All of the primary IP ranges in every Subnetwork are allowed to Nat. - LIST_OF_SUBNETWORKS: A list of Subnetworks are allowed to Nat (specified in the field subnetwork below) The default is SUBNETWORK_IP_RANGE_TO_NAT_OPTION_UNSPECIFIED. Note that if this field contains ALL_SUBNETWORKS_ALL_IP_RANGES or ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, then there should not be any other Router.Nat section in any Router for this network in this region.
       &quot;subnetworks&quot;: [ # A list of Subnetwork resources whose traffic should be translated by NAT Gateway. It is used only when LIST_OF_SUBNETWORKS is selected for the SubnetworkIpRangeToNatOption above.
         { # Defines the IP ranges that want to use NAT for a subnetwork.
@@ -814,6 +901,7 @@
         },
       ],
       &quot;tcpEstablishedIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP established connections. Defaults to 1200s if not set.
+      &quot;tcpTimeWaitTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP connections that are in TIME_WAIT state. Defaults to 120s if not set.
       &quot;tcpTransitoryIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP transitory connections. Defaults to 30s if not set.
       &quot;udpIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for UDP connections. Defaults to 30s if not set.
     },
@@ -981,6 +1069,21 @@
           &quot;natIps&quot;: [ # A list of URLs of the IP resources used for this Nat service. These IP addresses must be valid static external IP addresses assigned to the project.
             &quot;A String&quot;,
           ],
+          &quot;rules&quot;: [ # A list of rules associated with this NAT.
+            {
+              &quot;action&quot;: { # The action to be enforced for traffic that matches this rule.
+                &quot;sourceNatActiveIps&quot;: [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project. This field is used for public NAT.
+                  &quot;A String&quot;,
+                ],
+                &quot;sourceNatDrainIps&quot;: [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only. This field is used for public NAT.
+                  &quot;A String&quot;,
+                ],
+              },
+              &quot;description&quot;: &quot;A String&quot;, # An optional description of this rule.
+              &quot;match&quot;: &quot;A String&quot;, # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions for public NAT: &quot;inIpRange(destination.ip, &#x27;1.1.0.0/16&#x27;) || inIpRange(destination.ip, &#x27;2.2.0.0/16&#x27;)&quot; &quot;destination.ip == &#x27;1.1.0.1&#x27; || destination.ip == &#x27;8.8.8.8&#x27;&quot; The following example is a valid match expression for private NAT: &quot;nexthop.hub == &#x27;/projects/my-project/global/hub/hub-1&#x27;&quot;
+              &quot;ruleNumber&quot;: 42, # An integer uniquely identifying a rule in the list. The rule number must be a positive value between 0 and 65000, and must be unique among rules within a NAT.
+            },
+          ],
           &quot;sourceSubnetworkIpRangesToNat&quot;: &quot;A String&quot;, # Specify the Nat option, which can take one of the following values: - ALL_SUBNETWORKS_ALL_IP_RANGES: All of the IP ranges in every Subnetwork are allowed to Nat. - ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES: All of the primary IP ranges in every Subnetwork are allowed to Nat. - LIST_OF_SUBNETWORKS: A list of Subnetworks are allowed to Nat (specified in the field subnetwork below) The default is SUBNETWORK_IP_RANGE_TO_NAT_OPTION_UNSPECIFIED. Note that if this field contains ALL_SUBNETWORKS_ALL_IP_RANGES or ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, then there should not be any other Router.Nat section in any Router for this network in this region.
           &quot;subnetworks&quot;: [ # A list of Subnetwork resources whose traffic should be translated by NAT Gateway. It is used only when LIST_OF_SUBNETWORKS is selected for the SubnetworkIpRangeToNatOption above.
             { # Defines the IP ranges that want to use NAT for a subnetwork.
@@ -994,6 +1097,7 @@
             },
           ],
           &quot;tcpEstablishedIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP established connections. Defaults to 1200s if not set.
+          &quot;tcpTimeWaitTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP connections that are in TIME_WAIT state. Defaults to 120s if not set.
           &quot;tcpTransitoryIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP transitory connections. Defaults to 30s if not set.
           &quot;udpIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for UDP connections. Defaults to 30s if not set.
         },
@@ -1123,6 +1227,21 @@
       &quot;natIps&quot;: [ # A list of URLs of the IP resources used for this Nat service. These IP addresses must be valid static external IP addresses assigned to the project.
         &quot;A String&quot;,
       ],
+      &quot;rules&quot;: [ # A list of rules associated with this NAT.
+        {
+          &quot;action&quot;: { # The action to be enforced for traffic that matches this rule.
+            &quot;sourceNatActiveIps&quot;: [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project. This field is used for public NAT.
+              &quot;A String&quot;,
+            ],
+            &quot;sourceNatDrainIps&quot;: [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only. This field is used for public NAT.
+              &quot;A String&quot;,
+            ],
+          },
+          &quot;description&quot;: &quot;A String&quot;, # An optional description of this rule.
+          &quot;match&quot;: &quot;A String&quot;, # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions for public NAT: &quot;inIpRange(destination.ip, &#x27;1.1.0.0/16&#x27;) || inIpRange(destination.ip, &#x27;2.2.0.0/16&#x27;)&quot; &quot;destination.ip == &#x27;1.1.0.1&#x27; || destination.ip == &#x27;8.8.8.8&#x27;&quot; The following example is a valid match expression for private NAT: &quot;nexthop.hub == &#x27;/projects/my-project/global/hub/hub-1&#x27;&quot;
+          &quot;ruleNumber&quot;: 42, # An integer uniquely identifying a rule in the list. The rule number must be a positive value between 0 and 65000, and must be unique among rules within a NAT.
+        },
+      ],
       &quot;sourceSubnetworkIpRangesToNat&quot;: &quot;A String&quot;, # Specify the Nat option, which can take one of the following values: - ALL_SUBNETWORKS_ALL_IP_RANGES: All of the IP ranges in every Subnetwork are allowed to Nat. - ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES: All of the primary IP ranges in every Subnetwork are allowed to Nat. - LIST_OF_SUBNETWORKS: A list of Subnetworks are allowed to Nat (specified in the field subnetwork below) The default is SUBNETWORK_IP_RANGE_TO_NAT_OPTION_UNSPECIFIED. Note that if this field contains ALL_SUBNETWORKS_ALL_IP_RANGES or ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, then there should not be any other Router.Nat section in any Router for this network in this region.
       &quot;subnetworks&quot;: [ # A list of Subnetwork resources whose traffic should be translated by NAT Gateway. It is used only when LIST_OF_SUBNETWORKS is selected for the SubnetworkIpRangeToNatOption above.
         { # Defines the IP ranges that want to use NAT for a subnetwork.
@@ -1136,6 +1255,7 @@
         },
       ],
       &quot;tcpEstablishedIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP established connections. Defaults to 1200s if not set.
+      &quot;tcpTimeWaitTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP connections that are in TIME_WAIT state. Defaults to 120s if not set.
       &quot;tcpTransitoryIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP transitory connections. Defaults to 30s if not set.
       &quot;udpIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for UDP connections. Defaults to 30s if not set.
     },
@@ -1291,6 +1411,21 @@
       &quot;natIps&quot;: [ # A list of URLs of the IP resources used for this Nat service. These IP addresses must be valid static external IP addresses assigned to the project.
         &quot;A String&quot;,
       ],
+      &quot;rules&quot;: [ # A list of rules associated with this NAT.
+        {
+          &quot;action&quot;: { # The action to be enforced for traffic that matches this rule.
+            &quot;sourceNatActiveIps&quot;: [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project. This field is used for public NAT.
+              &quot;A String&quot;,
+            ],
+            &quot;sourceNatDrainIps&quot;: [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only. This field is used for public NAT.
+              &quot;A String&quot;,
+            ],
+          },
+          &quot;description&quot;: &quot;A String&quot;, # An optional description of this rule.
+          &quot;match&quot;: &quot;A String&quot;, # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions for public NAT: &quot;inIpRange(destination.ip, &#x27;1.1.0.0/16&#x27;) || inIpRange(destination.ip, &#x27;2.2.0.0/16&#x27;)&quot; &quot;destination.ip == &#x27;1.1.0.1&#x27; || destination.ip == &#x27;8.8.8.8&#x27;&quot; The following example is a valid match expression for private NAT: &quot;nexthop.hub == &#x27;/projects/my-project/global/hub/hub-1&#x27;&quot;
+          &quot;ruleNumber&quot;: 42, # An integer uniquely identifying a rule in the list. The rule number must be a positive value between 0 and 65000, and must be unique among rules within a NAT.
+        },
+      ],
       &quot;sourceSubnetworkIpRangesToNat&quot;: &quot;A String&quot;, # Specify the Nat option, which can take one of the following values: - ALL_SUBNETWORKS_ALL_IP_RANGES: All of the IP ranges in every Subnetwork are allowed to Nat. - ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES: All of the primary IP ranges in every Subnetwork are allowed to Nat. - LIST_OF_SUBNETWORKS: A list of Subnetworks are allowed to Nat (specified in the field subnetwork below) The default is SUBNETWORK_IP_RANGE_TO_NAT_OPTION_UNSPECIFIED. Note that if this field contains ALL_SUBNETWORKS_ALL_IP_RANGES or ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, then there should not be any other Router.Nat section in any Router for this network in this region.
       &quot;subnetworks&quot;: [ # A list of Subnetwork resources whose traffic should be translated by NAT Gateway. It is used only when LIST_OF_SUBNETWORKS is selected for the SubnetworkIpRangeToNatOption above.
         { # Defines the IP ranges that want to use NAT for a subnetwork.
@@ -1304,6 +1439,7 @@
         },
       ],
       &quot;tcpEstablishedIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP established connections. Defaults to 1200s if not set.
+      &quot;tcpTimeWaitTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP connections that are in TIME_WAIT state. Defaults to 120s if not set.
       &quot;tcpTransitoryIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP transitory connections. Defaults to 30s if not set.
       &quot;udpIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for UDP connections. Defaults to 30s if not set.
     },
@@ -1401,6 +1537,21 @@
         &quot;natIps&quot;: [ # A list of URLs of the IP resources used for this Nat service. These IP addresses must be valid static external IP addresses assigned to the project.
           &quot;A String&quot;,
         ],
+        &quot;rules&quot;: [ # A list of rules associated with this NAT.
+          {
+            &quot;action&quot;: { # The action to be enforced for traffic that matches this rule.
+              &quot;sourceNatActiveIps&quot;: [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project. This field is used for public NAT.
+                &quot;A String&quot;,
+              ],
+              &quot;sourceNatDrainIps&quot;: [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only. This field is used for public NAT.
+                &quot;A String&quot;,
+              ],
+            },
+            &quot;description&quot;: &quot;A String&quot;, # An optional description of this rule.
+            &quot;match&quot;: &quot;A String&quot;, # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions for public NAT: &quot;inIpRange(destination.ip, &#x27;1.1.0.0/16&#x27;) || inIpRange(destination.ip, &#x27;2.2.0.0/16&#x27;)&quot; &quot;destination.ip == &#x27;1.1.0.1&#x27; || destination.ip == &#x27;8.8.8.8&#x27;&quot; The following example is a valid match expression for private NAT: &quot;nexthop.hub == &#x27;/projects/my-project/global/hub/hub-1&#x27;&quot;
+            &quot;ruleNumber&quot;: 42, # An integer uniquely identifying a rule in the list. The rule number must be a positive value between 0 and 65000, and must be unique among rules within a NAT.
+          },
+        ],
         &quot;sourceSubnetworkIpRangesToNat&quot;: &quot;A String&quot;, # Specify the Nat option, which can take one of the following values: - ALL_SUBNETWORKS_ALL_IP_RANGES: All of the IP ranges in every Subnetwork are allowed to Nat. - ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES: All of the primary IP ranges in every Subnetwork are allowed to Nat. - LIST_OF_SUBNETWORKS: A list of Subnetworks are allowed to Nat (specified in the field subnetwork below) The default is SUBNETWORK_IP_RANGE_TO_NAT_OPTION_UNSPECIFIED. Note that if this field contains ALL_SUBNETWORKS_ALL_IP_RANGES or ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, then there should not be any other Router.Nat section in any Router for this network in this region.
         &quot;subnetworks&quot;: [ # A list of Subnetwork resources whose traffic should be translated by NAT Gateway. It is used only when LIST_OF_SUBNETWORKS is selected for the SubnetworkIpRangeToNatOption above.
           { # Defines the IP ranges that want to use NAT for a subnetwork.
@@ -1414,6 +1565,7 @@
           },
         ],
         &quot;tcpEstablishedIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP established connections. Defaults to 1200s if not set.
+        &quot;tcpTimeWaitTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP connections that are in TIME_WAIT state. Defaults to 120s if not set.
         &quot;tcpTransitoryIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP transitory connections. Defaults to 30s if not set.
         &quot;udpIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for UDP connections. Defaults to 30s if not set.
       },
@@ -1515,6 +1667,21 @@
       &quot;natIps&quot;: [ # A list of URLs of the IP resources used for this Nat service. These IP addresses must be valid static external IP addresses assigned to the project.
         &quot;A String&quot;,
       ],
+      &quot;rules&quot;: [ # A list of rules associated with this NAT.
+        {
+          &quot;action&quot;: { # The action to be enforced for traffic that matches this rule.
+            &quot;sourceNatActiveIps&quot;: [ # A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project. This field is used for public NAT.
+              &quot;A String&quot;,
+            ],
+            &quot;sourceNatDrainIps&quot;: [ # A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only. This field is used for public NAT.
+              &quot;A String&quot;,
+            ],
+          },
+          &quot;description&quot;: &quot;A String&quot;, # An optional description of this rule.
+          &quot;match&quot;: &quot;A String&quot;, # CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding `action` is enforced. The following examples are valid match expressions for public NAT: &quot;inIpRange(destination.ip, &#x27;1.1.0.0/16&#x27;) || inIpRange(destination.ip, &#x27;2.2.0.0/16&#x27;)&quot; &quot;destination.ip == &#x27;1.1.0.1&#x27; || destination.ip == &#x27;8.8.8.8&#x27;&quot; The following example is a valid match expression for private NAT: &quot;nexthop.hub == &#x27;/projects/my-project/global/hub/hub-1&#x27;&quot;
+          &quot;ruleNumber&quot;: 42, # An integer uniquely identifying a rule in the list. The rule number must be a positive value between 0 and 65000, and must be unique among rules within a NAT.
+        },
+      ],
       &quot;sourceSubnetworkIpRangesToNat&quot;: &quot;A String&quot;, # Specify the Nat option, which can take one of the following values: - ALL_SUBNETWORKS_ALL_IP_RANGES: All of the IP ranges in every Subnetwork are allowed to Nat. - ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES: All of the primary IP ranges in every Subnetwork are allowed to Nat. - LIST_OF_SUBNETWORKS: A list of Subnetworks are allowed to Nat (specified in the field subnetwork below) The default is SUBNETWORK_IP_RANGE_TO_NAT_OPTION_UNSPECIFIED. Note that if this field contains ALL_SUBNETWORKS_ALL_IP_RANGES or ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, then there should not be any other Router.Nat section in any Router for this network in this region.
       &quot;subnetworks&quot;: [ # A list of Subnetwork resources whose traffic should be translated by NAT Gateway. It is used only when LIST_OF_SUBNETWORKS is selected for the SubnetworkIpRangeToNatOption above.
         { # Defines the IP ranges that want to use NAT for a subnetwork.
@@ -1528,6 +1695,7 @@
         },
       ],
       &quot;tcpEstablishedIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP established connections. Defaults to 1200s if not set.
+      &quot;tcpTimeWaitTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP connections that are in TIME_WAIT state. Defaults to 120s if not set.
       &quot;tcpTransitoryIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for TCP transitory connections. Defaults to 30s if not set.
       &quot;udpIdleTimeoutSec&quot;: 42, # Timeout (in seconds) for UDP connections. Defaults to 30s if not set.
     },
diff --git a/docs/dyn/compute_v1.routes.html b/docs/dyn/compute_v1.routes.html
index f9cd52a..786da38 100644
--- a/docs/dyn/compute_v1.routes.html
+++ b/docs/dyn/compute_v1.routes.html
@@ -177,6 +177,14 @@
   An object of the form:
 
     { # Represents a Route resource. A route defines a path from VM instances in the VPC network to a specific destination. This destination can be inside or outside the VPC network. For more information, read the Routes overview.
+  &quot;asPaths&quot;: [ # [Output Only] AS path.
+    {
+      &quot;asLists&quot;: [ # [Output Only] The AS numbers of the AS Path.
+        42,
+      ],
+      &quot;pathSegmentType&quot;: &quot;A String&quot;, # [Output Only] The type of the AS Path, which can be one of the following values: - &#x27;AS_SET&#x27;: unordered set of autonomous systems that the route in has traversed - &#x27;AS_SEQUENCE&#x27;: ordered set of autonomous systems that the route has traversed - &#x27;AS_CONFED_SEQUENCE&#x27;: ordered set of Member Autonomous Systems in the local confederation that the route has traversed - &#x27;AS_CONFED_SET&#x27;: unordered set of Member Autonomous Systems in the local confederation that the route has traversed
+    },
+  ],
   &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
   &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this field when you create the resource.
   &quot;destRange&quot;: &quot;A String&quot;, # The destination range of outgoing packets that this route applies to. Both IPv4 and IPv6 are supported.
@@ -192,6 +200,7 @@
   &quot;nextHopPeering&quot;: &quot;A String&quot;, # [Output Only] The network peering name that should handle matching packets, which should conform to RFC1035.
   &quot;nextHopVpnTunnel&quot;: &quot;A String&quot;, # The URL to a VpnTunnel that should handle matching packets.
   &quot;priority&quot;: 42, # The priority of this route. Priority is used to break ties in cases where there is more than one matching route of equal prefix length. In cases where multiple routes have equal prefix length, the one with the lowest-numbered priority value wins. The default value is `1000`. The priority value must be from `0` to `65535`, inclusive.
+  &quot;routeType&quot;: &quot;A String&quot;, # [Output Only] The type of this route, which can be one of the following values: - &#x27;TRANSIT&#x27; for a transit route that this router learned from another Cloud Router and will readvertise to one of its BGP peers - &#x27;SUBNET&#x27; for a route from a subnet of the VPC - &#x27;BGP&#x27; for a route learned from a BGP peer of this router - &#x27;STATIC&#x27; for a static route
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined fully-qualified URL for this resource.
   &quot;tags&quot;: [ # A list of instance tags to which this route applies.
     &quot;A String&quot;,
@@ -221,6 +230,14 @@
     The object takes the form of:
 
 { # Represents a Route resource. A route defines a path from VM instances in the VPC network to a specific destination. This destination can be inside or outside the VPC network. For more information, read the Routes overview.
+  &quot;asPaths&quot;: [ # [Output Only] AS path.
+    {
+      &quot;asLists&quot;: [ # [Output Only] The AS numbers of the AS Path.
+        42,
+      ],
+      &quot;pathSegmentType&quot;: &quot;A String&quot;, # [Output Only] The type of the AS Path, which can be one of the following values: - &#x27;AS_SET&#x27;: unordered set of autonomous systems that the route in has traversed - &#x27;AS_SEQUENCE&#x27;: ordered set of autonomous systems that the route has traversed - &#x27;AS_CONFED_SEQUENCE&#x27;: ordered set of Member Autonomous Systems in the local confederation that the route has traversed - &#x27;AS_CONFED_SET&#x27;: unordered set of Member Autonomous Systems in the local confederation that the route has traversed
+    },
+  ],
   &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
   &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this field when you create the resource.
   &quot;destRange&quot;: &quot;A String&quot;, # The destination range of outgoing packets that this route applies to. Both IPv4 and IPv6 are supported.
@@ -236,6 +253,7 @@
   &quot;nextHopPeering&quot;: &quot;A String&quot;, # [Output Only] The network peering name that should handle matching packets, which should conform to RFC1035.
   &quot;nextHopVpnTunnel&quot;: &quot;A String&quot;, # The URL to a VpnTunnel that should handle matching packets.
   &quot;priority&quot;: 42, # The priority of this route. Priority is used to break ties in cases where there is more than one matching route of equal prefix length. In cases where multiple routes have equal prefix length, the one with the lowest-numbered priority value wins. The default value is `1000`. The priority value must be from `0` to `65535`, inclusive.
+  &quot;routeType&quot;: &quot;A String&quot;, # [Output Only] The type of this route, which can be one of the following values: - &#x27;TRANSIT&#x27; for a transit route that this router learned from another Cloud Router and will readvertise to one of its BGP peers - &#x27;SUBNET&#x27; for a route from a subnet of the VPC - &#x27;BGP&#x27; for a route learned from a BGP peer of this router - &#x27;STATIC&#x27; for a static route
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined fully-qualified URL for this resource.
   &quot;tags&quot;: [ # A list of instance tags to which this route applies.
     &quot;A String&quot;,
@@ -333,6 +351,14 @@
   &quot;id&quot;: &quot;A String&quot;, # [Output Only] Unique identifier for the resource; defined by the server.
   &quot;items&quot;: [ # A list of Route resources.
     { # Represents a Route resource. A route defines a path from VM instances in the VPC network to a specific destination. This destination can be inside or outside the VPC network. For more information, read the Routes overview.
+      &quot;asPaths&quot;: [ # [Output Only] AS path.
+        {
+          &quot;asLists&quot;: [ # [Output Only] The AS numbers of the AS Path.
+            42,
+          ],
+          &quot;pathSegmentType&quot;: &quot;A String&quot;, # [Output Only] The type of the AS Path, which can be one of the following values: - &#x27;AS_SET&#x27;: unordered set of autonomous systems that the route in has traversed - &#x27;AS_SEQUENCE&#x27;: ordered set of autonomous systems that the route has traversed - &#x27;AS_CONFED_SEQUENCE&#x27;: ordered set of Member Autonomous Systems in the local confederation that the route has traversed - &#x27;AS_CONFED_SET&#x27;: unordered set of Member Autonomous Systems in the local confederation that the route has traversed
+        },
+      ],
       &quot;creationTimestamp&quot;: &quot;A String&quot;, # [Output Only] Creation timestamp in RFC3339 text format.
       &quot;description&quot;: &quot;A String&quot;, # An optional description of this resource. Provide this field when you create the resource.
       &quot;destRange&quot;: &quot;A String&quot;, # The destination range of outgoing packets that this route applies to. Both IPv4 and IPv6 are supported.
@@ -348,6 +374,7 @@
       &quot;nextHopPeering&quot;: &quot;A String&quot;, # [Output Only] The network peering name that should handle matching packets, which should conform to RFC1035.
       &quot;nextHopVpnTunnel&quot;: &quot;A String&quot;, # The URL to a VpnTunnel that should handle matching packets.
       &quot;priority&quot;: 42, # The priority of this route. Priority is used to break ties in cases where there is more than one matching route of equal prefix length. In cases where multiple routes have equal prefix length, the one with the lowest-numbered priority value wins. The default value is `1000`. The priority value must be from `0` to `65535`, inclusive.
+      &quot;routeType&quot;: &quot;A String&quot;, # [Output Only] The type of this route, which can be one of the following values: - &#x27;TRANSIT&#x27; for a transit route that this router learned from another Cloud Router and will readvertise to one of its BGP peers - &#x27;SUBNET&#x27; for a route from a subnet of the VPC - &#x27;BGP&#x27; for a route learned from a BGP peer of this router - &#x27;STATIC&#x27; for a static route
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined fully-qualified URL for this resource.
       &quot;tags&quot;: [ # A list of instance tags to which this route applies.
         &quot;A String&quot;,
diff --git a/docs/dyn/compute_v1.snapshots.html b/docs/dyn/compute_v1.snapshots.html
index adf2537..56f5474 100644
--- a/docs/dyn/compute_v1.snapshots.html
+++ b/docs/dyn/compute_v1.snapshots.html
@@ -209,18 +209,18 @@
   &quot;satisfiesPzs&quot;: True or False, # [Output Only] Reserved for future use.
   &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
   &quot;snapshotEncryptionKey&quot;: { # Encrypts the snapshot using a customer-supplied encryption key. After you encrypt a snapshot using a customer-supplied key, you must provide the same key if you use the snapshot later. For example, you must provide the encryption key when you create a disk from the encrypted snapshot in a future request. Customer-supplied encryption keys do not protect access to metadata of the snapshot. If you do not provide an encryption key when creating the snapshot, then the snapshot will be encrypted using an automatically generated key and you do not need to provide a key to use the snapshot later.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDisk&quot;: &quot;A String&quot;, # The source disk used to create this snapshot.
   &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+    &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+    &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+    &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
     &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
   },
   &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this snapshot. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given disk name.
@@ -383,18 +383,18 @@
       &quot;satisfiesPzs&quot;: True or False, # [Output Only] Reserved for future use.
       &quot;selfLink&quot;: &quot;A String&quot;, # [Output Only] Server-defined URL for the resource.
       &quot;snapshotEncryptionKey&quot;: { # Encrypts the snapshot using a customer-supplied encryption key. After you encrypt a snapshot using a customer-supplied key, you must provide the same key if you use the snapshot later. For example, you must provide the encryption key when you create a disk from the encrypted snapshot in a future request. Customer-supplied encryption keys do not protect access to metadata of the snapshot. If you do not provide an encryption key when creating the snapshot, then the snapshot will be encrypted using an automatically generated key and you do not need to provide a key to use the snapshot later.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceDisk&quot;: &quot;A String&quot;, # The source disk used to create this snapshot.
       &quot;sourceDiskEncryptionKey&quot;: { # The customer-supplied encryption key of the source disk. Required if the source disk is protected by a customer-supplied encryption key.
-        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS.
-        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used.
-        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
-        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
+        &quot;kmsKeyName&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS. For example: &quot;kmsKeyName&quot;: &quot;projects/kms_project_id/locations/region/keyRings/ key_region/cryptoKeys/key
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. For example: &quot;kmsKeyServiceAccount&quot;: &quot;name@project_id.iam.gserviceaccount.com/
+        &quot;rawKey&quot;: &quot;A String&quot;, # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rawKey&quot;: &quot;SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=&quot;
+        &quot;rsaEncryptedKey&quot;: &quot;A String&quot;, # Specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption key to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey. For example: &quot;rsaEncryptedKey&quot;: &quot;ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFH z0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoD D6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==&quot; The key must meet the following requirements before you can provide it to Compute Engine: 1. The key is wrapped using a RSA public key certificate provided by Google. 2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding. Gets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem
         &quot;sha256&quot;: &quot;A String&quot;, # [Output only] The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
       },
       &quot;sourceDiskId&quot;: &quot;A String&quot;, # [Output Only] The ID value of the disk used to create this snapshot. This value may be used to determine whether the snapshot was taken from the current or a previous instance of a given disk name.
diff --git a/docs/dyn/connectors_v1.html b/docs/dyn/connectors_v1.html
new file mode 100644
index 0000000..d029e9b
--- /dev/null
+++ b/docs/dyn/connectors_v1.html
@@ -0,0 +1,111 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="connectors_v1.html">Connectors API</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="connectors_v1.projects.html">projects()</a></code>
+</p>
+<p class="firstline">Returns the projects Resource.</p>
+
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#new_batch_http_request">new_batch_http_request()</a></code></p>
+<p class="firstline">Create a BatchHttpRequest object based on the discovery document.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="new_batch_http_request">new_batch_http_request()</code>
+  <pre>Create a BatchHttpRequest object based on the discovery document.
+
+        Args:
+          callback: callable, A callback to be called for each response, of the
+            form callback(id, response, exception). The first parameter is the
+            request id, and the second is the deserialized response object. The
+            third is an apiclient.errors.HttpError exception object if an HTTP
+            error occurred while processing the request, or None if no error
+            occurred.
+
+        Returns:
+          A BatchHttpRequest object based on the discovery document.
+        </pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/connectors_v1.projects.html b/docs/dyn/connectors_v1.projects.html
new file mode 100644
index 0000000..4141aca
--- /dev/null
+++ b/docs/dyn/connectors_v1.projects.html
@@ -0,0 +1,91 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="connectors_v1.html">Connectors API</a> . <a href="connectors_v1.projects.html">projects</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="connectors_v1.projects.locations.html">locations()</a></code>
+</p>
+<p class="firstline">Returns the locations Resource.</p>
+
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/connectors_v1.projects.locations.connections.html b/docs/dyn/connectors_v1.projects.locations.connections.html
new file mode 100644
index 0000000..fb1737d
--- /dev/null
+++ b/docs/dyn/connectors_v1.projects.locations.connections.html
@@ -0,0 +1,792 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="connectors_v1.html">Connectors API</a> . <a href="connectors_v1.projects.html">projects</a> . <a href="connectors_v1.projects.locations.html">locations</a> . <a href="connectors_v1.projects.locations.connections.html">connections</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="connectors_v1.projects.locations.connections.runtimeActionSchemas.html">runtimeActionSchemas()</a></code>
+</p>
+<p class="firstline">Returns the runtimeActionSchemas Resource.</p>
+
+<p class="toc_element">
+  <code><a href="connectors_v1.projects.locations.connections.runtimeEntitySchemas.html">runtimeEntitySchemas()</a></code>
+</p>
+<p class="firstline">Returns the runtimeEntitySchemas Resource.</p>
+
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#create">create(parent, body=None, connectionId=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Creates a new Connection in a given project and location.</p>
+<p class="toc_element">
+  <code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>
+<p class="firstline">Deletes a single Connection.</p>
+<p class="toc_element">
+  <code><a href="#get">get(name, view=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets details of a single Connection.</p>
+<p class="toc_element">
+  <code><a href="#getConnectionSchemaMetadata">getConnectionSchemaMetadata(name, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets schema metadata of a connection. SchemaMetadata is a singleton resource for each connection.</p>
+<p class="toc_element">
+  <code><a href="#getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.</p>
+<p class="toc_element">
+  <code><a href="#list">list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, view=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Lists Connections in a given project and location.</p>
+<p class="toc_element">
+  <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
+<p class="firstline">Retrieves the next page of results.</p>
+<p class="toc_element">
+  <code><a href="#patch">patch(name, body=None, updateMask=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Updates the parameters of a single Connection.</p>
+<p class="toc_element">
+  <code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.</p>
+<p class="toc_element">
+  <code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may "fail open" without warning.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="create">create(parent, body=None, connectionId=None, x__xgafv=None)</code>
+  <pre>Creates a new Connection in a given project and location.
+
+Args:
+  parent: string, Required. Parent resource of the Connection, of the form: `projects/*/locations/*` (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Connection represents an instance of connector.
+  &quot;authConfig&quot;: { # AuthConfig defines details of a authentication type. # Optional. Configuration for establishing the connection&#x27;s authentication with an external system.
+    &quot;additionalVariables&quot;: [ # List containing additional auth configs.
+      { # ConfigVariable represents a configuration variable present in a Connection. or AuthConfig.
+        &quot;boolValue&quot;: True or False, # Value is a bool.
+        &quot;intValue&quot;: &quot;A String&quot;, # Value is an integer
+        &quot;key&quot;: &quot;A String&quot;, # Key of the config variable.
+        &quot;secretValue&quot;: { # Secret provides a reference to entries in Secret Manager. # Value is a secret.
+          &quot;secretVersion&quot;: &quot;A String&quot;, # The resource name of the secret version in the format, format as: `projects/*/secrets/*/versions/*`.
+        },
+        &quot;stringValue&quot;: &quot;A String&quot;, # Value is a string.
+      },
+    ],
+    &quot;authType&quot;: &quot;A String&quot;, # The type of authentication configured.
+    &quot;oauth2ClientCredentials&quot;: { # Parameters to support Oauth 2.0 Client Credentials Grant Authentication. See https://tools.ietf.org/html/rfc6749#section-1.3.4 for more details. # Oauth2ClientCredentials.
+      &quot;clientId&quot;: &quot;A String&quot;, # The client identifier.
+      &quot;clientSecret&quot;: { # Secret provides a reference to entries in Secret Manager. # Secret version reference containing the client secret.
+        &quot;secretVersion&quot;: &quot;A String&quot;, # The resource name of the secret version in the format, format as: `projects/*/secrets/*/versions/*`.
+      },
+    },
+    &quot;oauth2JwtBearer&quot;: { # Parameters to support JSON Web Token (JWT) Profile for Oauth 2.0 Authorization Grant based authentication. See https://tools.ietf.org/html/rfc7523 for more details. # Oauth2JwtBearer.
+      &quot;clientKey&quot;: { # Secret provides a reference to entries in Secret Manager. # Secret version reference containing a PKCS#8 PEM-encoded private key associated with the Client Certificate. This private key will be used to sign JWTs used for the jwt-bearer authorization grant. Specified in the form as: `projects/*/secrets/*/versions/*`.
+        &quot;secretVersion&quot;: &quot;A String&quot;, # The resource name of the secret version in the format, format as: `projects/*/secrets/*/versions/*`.
+      },
+      &quot;jwtClaims&quot;: { # JWT claims used for the jwt-bearer authorization grant. # JwtClaims providers fields to generate the token.
+        &quot;audience&quot;: &quot;A String&quot;, # Value for the &quot;aud&quot; claim.
+        &quot;issuer&quot;: &quot;A String&quot;, # Value for the &quot;iss&quot; claim.
+        &quot;subject&quot;: &quot;A String&quot;, # Value for the &quot;sub&quot; claim.
+      },
+    },
+    &quot;userPassword&quot;: { # Parameters to support Username and Password Authentication. # UserPassword.
+      &quot;password&quot;: { # Secret provides a reference to entries in Secret Manager. # Secret version reference containing the password.
+        &quot;secretVersion&quot;: &quot;A String&quot;, # The resource name of the secret version in the format, format as: `projects/*/secrets/*/versions/*`.
+      },
+      &quot;username&quot;: &quot;A String&quot;, # Username.
+    },
+  },
+  &quot;configVariables&quot;: [ # Optional. Configuration for configuring the connection with an external system.
+    { # ConfigVariable represents a configuration variable present in a Connection. or AuthConfig.
+      &quot;boolValue&quot;: True or False, # Value is a bool.
+      &quot;intValue&quot;: &quot;A String&quot;, # Value is an integer
+      &quot;key&quot;: &quot;A String&quot;, # Key of the config variable.
+      &quot;secretValue&quot;: { # Secret provides a reference to entries in Secret Manager. # Value is a secret.
+        &quot;secretVersion&quot;: &quot;A String&quot;, # The resource name of the secret version in the format, format as: `projects/*/secrets/*/versions/*`.
+      },
+      &quot;stringValue&quot;: &quot;A String&quot;, # Value is a string.
+    },
+  ],
+  &quot;connectorVersion&quot;: &quot;A String&quot;, # Required. Connector version on which the connection is created. The format is: projects/*/locations/global/providers/*/connectors/*/versions/*
+  &quot;createTime&quot;: &quot;A String&quot;, # Output only. Created time.
+  &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the resource.
+  &quot;egressBackends&quot;: [ # Output only. Outbound domains/hosts needs to be allowlisted.
+    &quot;A String&quot;,
+  ],
+  &quot;envoyImageLocation&quot;: &quot;A String&quot;, # Output only. GCR location where the envoy image is stored. formatted like: gcr.io/{bucketName}/{imageName}
+  &quot;imageLocation&quot;: &quot;A String&quot;, # Output only. GCR location where the runtime image is stored. formatted like: gcr.io/{bucketName}/{imageName}
+  &quot;inactive&quot;: True or False, # Optional. Inactive indicates the connection is active to use or not.
+  &quot;labels&quot;: { # Optional. Resource labels to represent user-provided metadata. Refer to cloud documentation on labels for more details. https://cloud.google.com/compute/docs/labeling-resources
+    &quot;a_key&quot;: &quot;A String&quot;,
+  },
+  &quot;lockConfig&quot;: { # Determines whether or no a connection is locked. If locked, a reason must be specified. # Optional. Configuration that indicates whether or not the Connection can be edited.
+    &quot;locked&quot;: True or False, # Indicates whether or not the connection is locked.
+    &quot;reason&quot;: &quot;A String&quot;, # Describes why a connection is locked.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # Output only. Resource name of the Connection. Format: projects/{project}/locations/{location}/connections/{connection}
+  &quot;serviceAccount&quot;: &quot;A String&quot;, # Optional. Service account needed for runtime plane to access GCP resources.
+  &quot;serviceDirectory&quot;: &quot;A String&quot;, # Output only. The name of the Service Directory service name. Used for Private Harpoon to resolve the ILB address. e.g. &quot;projects/cloud-connectors-e2e-testing/locations/us-central1/namespaces/istio-system/services/istio-ingressgateway-connectors&quot;
+  &quot;status&quot;: { # ConnectionStatus indicates the state of the connection. # Output only. Current status of the connection.
+    &quot;description&quot;: &quot;A String&quot;, # Description.
+    &quot;state&quot;: &quot;A String&quot;, # State.
+    &quot;status&quot;: &quot;A String&quot;, # Status provides detailed information for the state.
+  },
+  &quot;updateTime&quot;: &quot;A String&quot;, # Output only. Updated time.
+}
+
+  connectionId: string, Required. Identifier to assign to the Connection. Must be unique within scope of the parent resource.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # This resource represents a long-running operation that is the result of a network API call.
+  &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+  &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+    &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+      {
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    ],
+    &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+  },
+  &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+  &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="delete">delete(name, x__xgafv=None)</code>
+  <pre>Deletes a single Connection.
+
+Args:
+  name: string, Required. Resource name of the form: `projects/*/locations/*/connections/*` (required)
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # This resource represents a long-running operation that is the result of a network API call.
+  &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+  &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+    &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+      {
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    ],
+    &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+  },
+  &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+  &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="get">get(name, view=None, x__xgafv=None)</code>
+  <pre>Gets details of a single Connection.
+
+Args:
+  name: string, Required. Resource name of the form: `projects/*/locations/*/connections/*` (required)
+  view: string, Specifies which fields of the Connection are returned in the response. Defaults to `BASIC` view.
+    Allowed values
+      CONNECTION_VIEW_UNSPECIFIED - CONNECTION_UNSPECIFIED.
+      BASIC - Do not include runtime required configs.
+      FULL - Include runtime required configs.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Connection represents an instance of connector.
+  &quot;authConfig&quot;: { # AuthConfig defines details of a authentication type. # Optional. Configuration for establishing the connection&#x27;s authentication with an external system.
+    &quot;additionalVariables&quot;: [ # List containing additional auth configs.
+      { # ConfigVariable represents a configuration variable present in a Connection. or AuthConfig.
+        &quot;boolValue&quot;: True or False, # Value is a bool.
+        &quot;intValue&quot;: &quot;A String&quot;, # Value is an integer
+        &quot;key&quot;: &quot;A String&quot;, # Key of the config variable.
+        &quot;secretValue&quot;: { # Secret provides a reference to entries in Secret Manager. # Value is a secret.
+          &quot;secretVersion&quot;: &quot;A String&quot;, # The resource name of the secret version in the format, format as: `projects/*/secrets/*/versions/*`.
+        },
+        &quot;stringValue&quot;: &quot;A String&quot;, # Value is a string.
+      },
+    ],
+    &quot;authType&quot;: &quot;A String&quot;, # The type of authentication configured.
+    &quot;oauth2ClientCredentials&quot;: { # Parameters to support Oauth 2.0 Client Credentials Grant Authentication. See https://tools.ietf.org/html/rfc6749#section-1.3.4 for more details. # Oauth2ClientCredentials.
+      &quot;clientId&quot;: &quot;A String&quot;, # The client identifier.
+      &quot;clientSecret&quot;: { # Secret provides a reference to entries in Secret Manager. # Secret version reference containing the client secret.
+        &quot;secretVersion&quot;: &quot;A String&quot;, # The resource name of the secret version in the format, format as: `projects/*/secrets/*/versions/*`.
+      },
+    },
+    &quot;oauth2JwtBearer&quot;: { # Parameters to support JSON Web Token (JWT) Profile for Oauth 2.0 Authorization Grant based authentication. See https://tools.ietf.org/html/rfc7523 for more details. # Oauth2JwtBearer.
+      &quot;clientKey&quot;: { # Secret provides a reference to entries in Secret Manager. # Secret version reference containing a PKCS#8 PEM-encoded private key associated with the Client Certificate. This private key will be used to sign JWTs used for the jwt-bearer authorization grant. Specified in the form as: `projects/*/secrets/*/versions/*`.
+        &quot;secretVersion&quot;: &quot;A String&quot;, # The resource name of the secret version in the format, format as: `projects/*/secrets/*/versions/*`.
+      },
+      &quot;jwtClaims&quot;: { # JWT claims used for the jwt-bearer authorization grant. # JwtClaims providers fields to generate the token.
+        &quot;audience&quot;: &quot;A String&quot;, # Value for the &quot;aud&quot; claim.
+        &quot;issuer&quot;: &quot;A String&quot;, # Value for the &quot;iss&quot; claim.
+        &quot;subject&quot;: &quot;A String&quot;, # Value for the &quot;sub&quot; claim.
+      },
+    },
+    &quot;userPassword&quot;: { # Parameters to support Username and Password Authentication. # UserPassword.
+      &quot;password&quot;: { # Secret provides a reference to entries in Secret Manager. # Secret version reference containing the password.
+        &quot;secretVersion&quot;: &quot;A String&quot;, # The resource name of the secret version in the format, format as: `projects/*/secrets/*/versions/*`.
+      },
+      &quot;username&quot;: &quot;A String&quot;, # Username.
+    },
+  },
+  &quot;configVariables&quot;: [ # Optional. Configuration for configuring the connection with an external system.
+    { # ConfigVariable represents a configuration variable present in a Connection. or AuthConfig.
+      &quot;boolValue&quot;: True or False, # Value is a bool.
+      &quot;intValue&quot;: &quot;A String&quot;, # Value is an integer
+      &quot;key&quot;: &quot;A String&quot;, # Key of the config variable.
+      &quot;secretValue&quot;: { # Secret provides a reference to entries in Secret Manager. # Value is a secret.
+        &quot;secretVersion&quot;: &quot;A String&quot;, # The resource name of the secret version in the format, format as: `projects/*/secrets/*/versions/*`.
+      },
+      &quot;stringValue&quot;: &quot;A String&quot;, # Value is a string.
+    },
+  ],
+  &quot;connectorVersion&quot;: &quot;A String&quot;, # Required. Connector version on which the connection is created. The format is: projects/*/locations/global/providers/*/connectors/*/versions/*
+  &quot;createTime&quot;: &quot;A String&quot;, # Output only. Created time.
+  &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the resource.
+  &quot;egressBackends&quot;: [ # Output only. Outbound domains/hosts needs to be allowlisted.
+    &quot;A String&quot;,
+  ],
+  &quot;envoyImageLocation&quot;: &quot;A String&quot;, # Output only. GCR location where the envoy image is stored. formatted like: gcr.io/{bucketName}/{imageName}
+  &quot;imageLocation&quot;: &quot;A String&quot;, # Output only. GCR location where the runtime image is stored. formatted like: gcr.io/{bucketName}/{imageName}
+  &quot;inactive&quot;: True or False, # Optional. Inactive indicates the connection is active to use or not.
+  &quot;labels&quot;: { # Optional. Resource labels to represent user-provided metadata. Refer to cloud documentation on labels for more details. https://cloud.google.com/compute/docs/labeling-resources
+    &quot;a_key&quot;: &quot;A String&quot;,
+  },
+  &quot;lockConfig&quot;: { # Determines whether or no a connection is locked. If locked, a reason must be specified. # Optional. Configuration that indicates whether or not the Connection can be edited.
+    &quot;locked&quot;: True or False, # Indicates whether or not the connection is locked.
+    &quot;reason&quot;: &quot;A String&quot;, # Describes why a connection is locked.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # Output only. Resource name of the Connection. Format: projects/{project}/locations/{location}/connections/{connection}
+  &quot;serviceAccount&quot;: &quot;A String&quot;, # Optional. Service account needed for runtime plane to access GCP resources.
+  &quot;serviceDirectory&quot;: &quot;A String&quot;, # Output only. The name of the Service Directory service name. Used for Private Harpoon to resolve the ILB address. e.g. &quot;projects/cloud-connectors-e2e-testing/locations/us-central1/namespaces/istio-system/services/istio-ingressgateway-connectors&quot;
+  &quot;status&quot;: { # ConnectionStatus indicates the state of the connection. # Output only. Current status of the connection.
+    &quot;description&quot;: &quot;A String&quot;, # Description.
+    &quot;state&quot;: &quot;A String&quot;, # State.
+    &quot;status&quot;: &quot;A String&quot;, # Status provides detailed information for the state.
+  },
+  &quot;updateTime&quot;: &quot;A String&quot;, # Output only. Updated time.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="getConnectionSchemaMetadata">getConnectionSchemaMetadata(name, x__xgafv=None)</code>
+  <pre>Gets schema metadata of a connection. SchemaMetadata is a singleton resource for each connection.
+
+Args:
+  name: string, Required. Connection name Format: projects/{project}/locations/{location}/connections/{connection}/connectionSchemaMetadata (required)
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Metadata of connection schema.
+  &quot;actions&quot;: [ # Output only. List of actions.
+    &quot;A String&quot;,
+  ],
+  &quot;entities&quot;: [ # Output only. List of entity names.
+    &quot;A String&quot;,
+  ],
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</code>
+  <pre>Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.
+
+Args:
+  resource: string, REQUIRED: The resource for which the policy is being requested. See the operation documentation for the appropriate value for this field. (required)
+  options_requestedPolicyVersion: integer, Optional. The policy format version to be returned. Valid values are 0, 1, and 3. Requests specifying an invalid value will be rejected. Requests for policies with any conditional bindings must specify version 3. Policies without any conditional bindings may specify any valid value or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+  &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
+    { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
+      &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
+        { # Provides the configuration for logging a type of permissions. Example: { &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; } ] } This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting jose@example.com from DATA_READ logging.
+          &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+            &quot;A String&quot;,
+          ],
+          &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
+        },
+      ],
+      &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+    },
+  ],
+  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member. The `bindings` in a `Policy` can refer to up to 1,500 members; up to 250 of these members can be Google groups. Each occurrence of a member counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other member, then you can add another 1,450 members to the `bindings` in the `Policy`.
+    { # Associates `members` with a `role`.
+      &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+        &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+        &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
+        &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+        &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+      },
+      &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+        &quot;A String&quot;,
+      ],
+      &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+    },
+  ],
+  &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+  &quot;version&quot;: 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list">list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, view=None, x__xgafv=None)</code>
+  <pre>Lists Connections in a given project and location.
+
+Args:
+  parent: string, Required. Parent resource of the Connection, of the form: `projects/*/locations/*` (required)
+  filter: string, Filter.
+  orderBy: string, Order by parameters.
+  pageSize: integer, Page size.
+  pageToken: string, Page token.
+  view: string, Specifies which fields of the Connection are returned in the response. Defaults to `BASIC` view.
+    Allowed values
+      CONNECTION_VIEW_UNSPECIFIED - CONNECTION_UNSPECIFIED.
+      BASIC - Do not include runtime required configs.
+      FULL - Include runtime required configs.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Response message for ConnectorsService.ListConnections
+  &quot;connections&quot;: [ # Connections.
+    { # Connection represents an instance of connector.
+      &quot;authConfig&quot;: { # AuthConfig defines details of a authentication type. # Optional. Configuration for establishing the connection&#x27;s authentication with an external system.
+        &quot;additionalVariables&quot;: [ # List containing additional auth configs.
+          { # ConfigVariable represents a configuration variable present in a Connection. or AuthConfig.
+            &quot;boolValue&quot;: True or False, # Value is a bool.
+            &quot;intValue&quot;: &quot;A String&quot;, # Value is an integer
+            &quot;key&quot;: &quot;A String&quot;, # Key of the config variable.
+            &quot;secretValue&quot;: { # Secret provides a reference to entries in Secret Manager. # Value is a secret.
+              &quot;secretVersion&quot;: &quot;A String&quot;, # The resource name of the secret version in the format, format as: `projects/*/secrets/*/versions/*`.
+            },
+            &quot;stringValue&quot;: &quot;A String&quot;, # Value is a string.
+          },
+        ],
+        &quot;authType&quot;: &quot;A String&quot;, # The type of authentication configured.
+        &quot;oauth2ClientCredentials&quot;: { # Parameters to support Oauth 2.0 Client Credentials Grant Authentication. See https://tools.ietf.org/html/rfc6749#section-1.3.4 for more details. # Oauth2ClientCredentials.
+          &quot;clientId&quot;: &quot;A String&quot;, # The client identifier.
+          &quot;clientSecret&quot;: { # Secret provides a reference to entries in Secret Manager. # Secret version reference containing the client secret.
+            &quot;secretVersion&quot;: &quot;A String&quot;, # The resource name of the secret version in the format, format as: `projects/*/secrets/*/versions/*`.
+          },
+        },
+        &quot;oauth2JwtBearer&quot;: { # Parameters to support JSON Web Token (JWT) Profile for Oauth 2.0 Authorization Grant based authentication. See https://tools.ietf.org/html/rfc7523 for more details. # Oauth2JwtBearer.
+          &quot;clientKey&quot;: { # Secret provides a reference to entries in Secret Manager. # Secret version reference containing a PKCS#8 PEM-encoded private key associated with the Client Certificate. This private key will be used to sign JWTs used for the jwt-bearer authorization grant. Specified in the form as: `projects/*/secrets/*/versions/*`.
+            &quot;secretVersion&quot;: &quot;A String&quot;, # The resource name of the secret version in the format, format as: `projects/*/secrets/*/versions/*`.
+          },
+          &quot;jwtClaims&quot;: { # JWT claims used for the jwt-bearer authorization grant. # JwtClaims providers fields to generate the token.
+            &quot;audience&quot;: &quot;A String&quot;, # Value for the &quot;aud&quot; claim.
+            &quot;issuer&quot;: &quot;A String&quot;, # Value for the &quot;iss&quot; claim.
+            &quot;subject&quot;: &quot;A String&quot;, # Value for the &quot;sub&quot; claim.
+          },
+        },
+        &quot;userPassword&quot;: { # Parameters to support Username and Password Authentication. # UserPassword.
+          &quot;password&quot;: { # Secret provides a reference to entries in Secret Manager. # Secret version reference containing the password.
+            &quot;secretVersion&quot;: &quot;A String&quot;, # The resource name of the secret version in the format, format as: `projects/*/secrets/*/versions/*`.
+          },
+          &quot;username&quot;: &quot;A String&quot;, # Username.
+        },
+      },
+      &quot;configVariables&quot;: [ # Optional. Configuration for configuring the connection with an external system.
+        { # ConfigVariable represents a configuration variable present in a Connection. or AuthConfig.
+          &quot;boolValue&quot;: True or False, # Value is a bool.
+          &quot;intValue&quot;: &quot;A String&quot;, # Value is an integer
+          &quot;key&quot;: &quot;A String&quot;, # Key of the config variable.
+          &quot;secretValue&quot;: { # Secret provides a reference to entries in Secret Manager. # Value is a secret.
+            &quot;secretVersion&quot;: &quot;A String&quot;, # The resource name of the secret version in the format, format as: `projects/*/secrets/*/versions/*`.
+          },
+          &quot;stringValue&quot;: &quot;A String&quot;, # Value is a string.
+        },
+      ],
+      &quot;connectorVersion&quot;: &quot;A String&quot;, # Required. Connector version on which the connection is created. The format is: projects/*/locations/global/providers/*/connectors/*/versions/*
+      &quot;createTime&quot;: &quot;A String&quot;, # Output only. Created time.
+      &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the resource.
+      &quot;egressBackends&quot;: [ # Output only. Outbound domains/hosts needs to be allowlisted.
+        &quot;A String&quot;,
+      ],
+      &quot;envoyImageLocation&quot;: &quot;A String&quot;, # Output only. GCR location where the envoy image is stored. formatted like: gcr.io/{bucketName}/{imageName}
+      &quot;imageLocation&quot;: &quot;A String&quot;, # Output only. GCR location where the runtime image is stored. formatted like: gcr.io/{bucketName}/{imageName}
+      &quot;inactive&quot;: True or False, # Optional. Inactive indicates the connection is active to use or not.
+      &quot;labels&quot;: { # Optional. Resource labels to represent user-provided metadata. Refer to cloud documentation on labels for more details. https://cloud.google.com/compute/docs/labeling-resources
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+      &quot;lockConfig&quot;: { # Determines whether or no a connection is locked. If locked, a reason must be specified. # Optional. Configuration that indicates whether or not the Connection can be edited.
+        &quot;locked&quot;: True or False, # Indicates whether or not the connection is locked.
+        &quot;reason&quot;: &quot;A String&quot;, # Describes why a connection is locked.
+      },
+      &quot;name&quot;: &quot;A String&quot;, # Output only. Resource name of the Connection. Format: projects/{project}/locations/{location}/connections/{connection}
+      &quot;serviceAccount&quot;: &quot;A String&quot;, # Optional. Service account needed for runtime plane to access GCP resources.
+      &quot;serviceDirectory&quot;: &quot;A String&quot;, # Output only. The name of the Service Directory service name. Used for Private Harpoon to resolve the ILB address. e.g. &quot;projects/cloud-connectors-e2e-testing/locations/us-central1/namespaces/istio-system/services/istio-ingressgateway-connectors&quot;
+      &quot;status&quot;: { # ConnectionStatus indicates the state of the connection. # Output only. Current status of the connection.
+        &quot;description&quot;: &quot;A String&quot;, # Description.
+        &quot;state&quot;: &quot;A String&quot;, # State.
+        &quot;status&quot;: &quot;A String&quot;, # Status provides detailed information for the state.
+      },
+      &quot;updateTime&quot;: &quot;A String&quot;, # Output only. Updated time.
+    },
+  ],
+  &quot;nextPageToken&quot;: &quot;A String&quot;, # Next page token.
+  &quot;unreachable&quot;: [ # Locations that could not be reached.
+    &quot;A String&quot;,
+  ],
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list_next">list_next(previous_request, previous_response)</code>
+  <pre>Retrieves the next page of results.
+
+Args:
+  previous_request: The request for the previous page. (required)
+  previous_response: The response from the request for the previous page. (required)
+
+Returns:
+  A request object that you can call &#x27;execute()&#x27; on to request the next
+  page. Returns None if there are no more items in the collection.
+    </pre>
+</div>
+
+<div class="method">
+    <code class="details" id="patch">patch(name, body=None, updateMask=None, x__xgafv=None)</code>
+  <pre>Updates the parameters of a single Connection.
+
+Args:
+  name: string, Output only. Resource name of the Connection. Format: projects/{project}/locations/{location}/connections/{connection} (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Connection represents an instance of connector.
+  &quot;authConfig&quot;: { # AuthConfig defines details of a authentication type. # Optional. Configuration for establishing the connection&#x27;s authentication with an external system.
+    &quot;additionalVariables&quot;: [ # List containing additional auth configs.
+      { # ConfigVariable represents a configuration variable present in a Connection. or AuthConfig.
+        &quot;boolValue&quot;: True or False, # Value is a bool.
+        &quot;intValue&quot;: &quot;A String&quot;, # Value is an integer
+        &quot;key&quot;: &quot;A String&quot;, # Key of the config variable.
+        &quot;secretValue&quot;: { # Secret provides a reference to entries in Secret Manager. # Value is a secret.
+          &quot;secretVersion&quot;: &quot;A String&quot;, # The resource name of the secret version in the format, format as: `projects/*/secrets/*/versions/*`.
+        },
+        &quot;stringValue&quot;: &quot;A String&quot;, # Value is a string.
+      },
+    ],
+    &quot;authType&quot;: &quot;A String&quot;, # The type of authentication configured.
+    &quot;oauth2ClientCredentials&quot;: { # Parameters to support Oauth 2.0 Client Credentials Grant Authentication. See https://tools.ietf.org/html/rfc6749#section-1.3.4 for more details. # Oauth2ClientCredentials.
+      &quot;clientId&quot;: &quot;A String&quot;, # The client identifier.
+      &quot;clientSecret&quot;: { # Secret provides a reference to entries in Secret Manager. # Secret version reference containing the client secret.
+        &quot;secretVersion&quot;: &quot;A String&quot;, # The resource name of the secret version in the format, format as: `projects/*/secrets/*/versions/*`.
+      },
+    },
+    &quot;oauth2JwtBearer&quot;: { # Parameters to support JSON Web Token (JWT) Profile for Oauth 2.0 Authorization Grant based authentication. See https://tools.ietf.org/html/rfc7523 for more details. # Oauth2JwtBearer.
+      &quot;clientKey&quot;: { # Secret provides a reference to entries in Secret Manager. # Secret version reference containing a PKCS#8 PEM-encoded private key associated with the Client Certificate. This private key will be used to sign JWTs used for the jwt-bearer authorization grant. Specified in the form as: `projects/*/secrets/*/versions/*`.
+        &quot;secretVersion&quot;: &quot;A String&quot;, # The resource name of the secret version in the format, format as: `projects/*/secrets/*/versions/*`.
+      },
+      &quot;jwtClaims&quot;: { # JWT claims used for the jwt-bearer authorization grant. # JwtClaims providers fields to generate the token.
+        &quot;audience&quot;: &quot;A String&quot;, # Value for the &quot;aud&quot; claim.
+        &quot;issuer&quot;: &quot;A String&quot;, # Value for the &quot;iss&quot; claim.
+        &quot;subject&quot;: &quot;A String&quot;, # Value for the &quot;sub&quot; claim.
+      },
+    },
+    &quot;userPassword&quot;: { # Parameters to support Username and Password Authentication. # UserPassword.
+      &quot;password&quot;: { # Secret provides a reference to entries in Secret Manager. # Secret version reference containing the password.
+        &quot;secretVersion&quot;: &quot;A String&quot;, # The resource name of the secret version in the format, format as: `projects/*/secrets/*/versions/*`.
+      },
+      &quot;username&quot;: &quot;A String&quot;, # Username.
+    },
+  },
+  &quot;configVariables&quot;: [ # Optional. Configuration for configuring the connection with an external system.
+    { # ConfigVariable represents a configuration variable present in a Connection. or AuthConfig.
+      &quot;boolValue&quot;: True or False, # Value is a bool.
+      &quot;intValue&quot;: &quot;A String&quot;, # Value is an integer
+      &quot;key&quot;: &quot;A String&quot;, # Key of the config variable.
+      &quot;secretValue&quot;: { # Secret provides a reference to entries in Secret Manager. # Value is a secret.
+        &quot;secretVersion&quot;: &quot;A String&quot;, # The resource name of the secret version in the format, format as: `projects/*/secrets/*/versions/*`.
+      },
+      &quot;stringValue&quot;: &quot;A String&quot;, # Value is a string.
+    },
+  ],
+  &quot;connectorVersion&quot;: &quot;A String&quot;, # Required. Connector version on which the connection is created. The format is: projects/*/locations/global/providers/*/connectors/*/versions/*
+  &quot;createTime&quot;: &quot;A String&quot;, # Output only. Created time.
+  &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the resource.
+  &quot;egressBackends&quot;: [ # Output only. Outbound domains/hosts needs to be allowlisted.
+    &quot;A String&quot;,
+  ],
+  &quot;envoyImageLocation&quot;: &quot;A String&quot;, # Output only. GCR location where the envoy image is stored. formatted like: gcr.io/{bucketName}/{imageName}
+  &quot;imageLocation&quot;: &quot;A String&quot;, # Output only. GCR location where the runtime image is stored. formatted like: gcr.io/{bucketName}/{imageName}
+  &quot;inactive&quot;: True or False, # Optional. Inactive indicates the connection is active to use or not.
+  &quot;labels&quot;: { # Optional. Resource labels to represent user-provided metadata. Refer to cloud documentation on labels for more details. https://cloud.google.com/compute/docs/labeling-resources
+    &quot;a_key&quot;: &quot;A String&quot;,
+  },
+  &quot;lockConfig&quot;: { # Determines whether or no a connection is locked. If locked, a reason must be specified. # Optional. Configuration that indicates whether or not the Connection can be edited.
+    &quot;locked&quot;: True or False, # Indicates whether or not the connection is locked.
+    &quot;reason&quot;: &quot;A String&quot;, # Describes why a connection is locked.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # Output only. Resource name of the Connection. Format: projects/{project}/locations/{location}/connections/{connection}
+  &quot;serviceAccount&quot;: &quot;A String&quot;, # Optional. Service account needed for runtime plane to access GCP resources.
+  &quot;serviceDirectory&quot;: &quot;A String&quot;, # Output only. The name of the Service Directory service name. Used for Private Harpoon to resolve the ILB address. e.g. &quot;projects/cloud-connectors-e2e-testing/locations/us-central1/namespaces/istio-system/services/istio-ingressgateway-connectors&quot;
+  &quot;status&quot;: { # ConnectionStatus indicates the state of the connection. # Output only. Current status of the connection.
+    &quot;description&quot;: &quot;A String&quot;, # Description.
+    &quot;state&quot;: &quot;A String&quot;, # State.
+    &quot;status&quot;: &quot;A String&quot;, # Status provides detailed information for the state.
+  },
+  &quot;updateTime&quot;: &quot;A String&quot;, # Output only. Updated time.
+}
+
+  updateMask: string, Field mask is used to specify the fields to be overwritten in the Connection resource by the update. The fields specified in the update_mask are relative to the resource, not the full request. A field will be overwritten if it is in the mask. If the user does not provide a mask then all fields will be overwritten.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # This resource represents a long-running operation that is the result of a network API call.
+  &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+  &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+    &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+      {
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    ],
+    &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+  },
+  &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+  &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>
+  <pre>Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.
+
+Args:
+  resource: string, REQUIRED: The resource for which the policy is being specified. See the operation documentation for the appropriate value for this field. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Request message for `SetIamPolicy` method.
+  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+    &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
+      { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
+        &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
+          { # Provides the configuration for logging a type of permissions. Example: { &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; } ] } This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting jose@example.com from DATA_READ logging.
+            &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+              &quot;A String&quot;,
+            ],
+            &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
+          },
+        ],
+        &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+      },
+    ],
+    &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member. The `bindings` in a `Policy` can refer to up to 1,500 members; up to 250 of these members can be Google groups. Each occurrence of a member counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other member, then you can add another 1,450 members to the `bindings` in the `Policy`.
+      { # Associates `members` with a `role`.
+        &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+          &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+          &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
+          &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+          &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+        },
+        &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+          &quot;A String&quot;,
+        ],
+        &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+      },
+    ],
+    &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+    &quot;version&quot;: 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+  },
+  &quot;updateMask&quot;: &quot;A String&quot;, # OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only the fields in the mask will be modified. If no mask is provided, the following default mask is used: `paths: &quot;bindings, etag&quot;`
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+  &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
+    { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
+      &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
+        { # Provides the configuration for logging a type of permissions. Example: { &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; } ] } This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting jose@example.com from DATA_READ logging.
+          &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+            &quot;A String&quot;,
+          ],
+          &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
+        },
+      ],
+      &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+    },
+  ],
+  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member. The `bindings` in a `Policy` can refer to up to 1,500 members; up to 250 of these members can be Google groups. Each occurrence of a member counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other member, then you can add another 1,450 members to the `bindings` in the `Policy`.
+    { # Associates `members` with a `role`.
+      &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+        &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+        &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
+        &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+        &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+      },
+      &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+        &quot;A String&quot;,
+      ],
+      &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+    },
+  ],
+  &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+  &quot;version&quot;: 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>
+  <pre>Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may &quot;fail open&quot; without warning.
+
+Args:
+  resource: string, REQUIRED: The resource for which the policy detail is being requested. See the operation documentation for the appropriate value for this field. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Request message for `TestIamPermissions` method.
+  &quot;permissions&quot;: [ # The set of permissions to check for the `resource`. Permissions with wildcards (such as &#x27;*&#x27; or &#x27;storage.*&#x27;) are not allowed. For more information see [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).
+    &quot;A String&quot;,
+  ],
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Response message for `TestIamPermissions` method.
+  &quot;permissions&quot;: [ # A subset of `TestPermissionsRequest.permissions` that the caller is allowed.
+    &quot;A String&quot;,
+  ],
+}</pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/connectors_v1.projects.locations.connections.runtimeActionSchemas.html b/docs/dyn/connectors_v1.projects.locations.connections.runtimeActionSchemas.html
new file mode 100644
index 0000000..38f9d81
--- /dev/null
+++ b/docs/dyn/connectors_v1.projects.locations.connections.runtimeActionSchemas.html
@@ -0,0 +1,149 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="connectors_v1.html">Connectors API</a> . <a href="connectors_v1.projects.html">projects</a> . <a href="connectors_v1.projects.locations.html">locations</a> . <a href="connectors_v1.projects.locations.connections.html">connections</a> . <a href="connectors_v1.projects.locations.connections.runtimeActionSchemas.html">runtimeActionSchemas</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#list">list(parent, filter=None, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>
+<p class="firstline">List schema of a runtime actions filtered by action name.</p>
+<p class="toc_element">
+  <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
+<p class="firstline">Retrieves the next page of results.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list">list(parent, filter=None, pageSize=None, pageToken=None, x__xgafv=None)</code>
+  <pre>List schema of a runtime actions filtered by action name.
+
+Args:
+  parent: string, Required. Parent resource of RuntimeActionSchema Format: projects/{project}/locations/{location}/connections/{connection} (required)
+  filter: string, Filter
+  pageSize: integer, Page size.
+  pageToken: string, Page token.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Response message for ConnectorsService.ListRuntimeActionSchemas.
+  &quot;nextPageToken&quot;: &quot;A String&quot;, # Next page token.
+  &quot;runtimeActionSchemas&quot;: [ # Runtime action schemas.
+    { # Schema of a runtime action.
+      &quot;action&quot;: &quot;A String&quot;, # Output only. Name of the action.
+      &quot;inputParameters&quot;: [ # Output only. List of input parameter metadata for the action.
+        { # Metadata of an input parameter.
+          &quot;dataType&quot;: &quot;A String&quot;, # The data type of the Parameter.
+          &quot;defaultValue&quot;: &quot;&quot;, # The following field specifies the default value of the Parameter provided by the external system if a value is not provided.
+          &quot;description&quot;: &quot;A String&quot;, # A brief description of the Parameter.
+          &quot;nullable&quot;: True or False, # Specifies whether a null value is allowed.
+          &quot;parameter&quot;: &quot;A String&quot;, # Name of the Parameter.
+        },
+      ],
+      &quot;resultMetadata&quot;: [ # Output only. List of result field metadata.
+        { # Metadata of result field.
+          &quot;dataType&quot;: &quot;A String&quot;, # The data type of the field.
+          &quot;description&quot;: &quot;A String&quot;, # A brief description of the field.
+          &quot;field&quot;: &quot;A String&quot;, # Name of the result field.
+        },
+      ],
+    },
+  ],
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list_next">list_next(previous_request, previous_response)</code>
+  <pre>Retrieves the next page of results.
+
+Args:
+  previous_request: The request for the previous page. (required)
+  previous_response: The response from the request for the previous page. (required)
+
+Returns:
+  A request object that you can call &#x27;execute()&#x27; on to request the next
+  page. Returns None if there are no more items in the collection.
+    </pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/connectors_v1.projects.locations.connections.runtimeEntitySchemas.html b/docs/dyn/connectors_v1.projects.locations.connections.runtimeEntitySchemas.html
new file mode 100644
index 0000000..a1a0755
--- /dev/null
+++ b/docs/dyn/connectors_v1.projects.locations.connections.runtimeEntitySchemas.html
@@ -0,0 +1,147 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="connectors_v1.html">Connectors API</a> . <a href="connectors_v1.projects.html">projects</a> . <a href="connectors_v1.projects.locations.html">locations</a> . <a href="connectors_v1.projects.locations.connections.html">connections</a> . <a href="connectors_v1.projects.locations.connections.runtimeEntitySchemas.html">runtimeEntitySchemas</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#list">list(parent, filter=None, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>
+<p class="firstline">List schema of a runtime entities filtered by entity name.</p>
+<p class="toc_element">
+  <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
+<p class="firstline">Retrieves the next page of results.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list">list(parent, filter=None, pageSize=None, pageToken=None, x__xgafv=None)</code>
+  <pre>List schema of a runtime entities filtered by entity name.
+
+Args:
+  parent: string, Required. Parent resource of RuntimeEntitySchema Format: projects/{project}/locations/{location}/connections/{connection} (required)
+  filter: string, Filter
+  pageSize: integer, Page size.
+  pageToken: string, Page token.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Response message for ConnectorsService.ListRuntimeEntitySchemas.
+  &quot;nextPageToken&quot;: &quot;A String&quot;, # Next page token.
+  &quot;runtimeEntitySchemas&quot;: [ # Runtime entity schemas.
+    { # Schema of a runtime entity.
+      &quot;entity&quot;: &quot;A String&quot;, # Output only. Name of the entity.
+      &quot;fields&quot;: [ # Output only. List of fields in the entity.
+        { # Metadata of an entity field.
+          &quot;additionalDetails&quot;: { # The following map contains fields that are not explicitly mentioned above,this give connectors the flexibility to add new metadata fields.
+            &quot;a_key&quot;: &quot;&quot;, # Properties of the object.
+          },
+          &quot;dataType&quot;: &quot;A String&quot;, # The data type of the Field.
+          &quot;defaultValue&quot;: &quot;&quot;, # The following field specifies the default value of the Field provided by the external system if a value is not provided.
+          &quot;description&quot;: &quot;A String&quot;, # A brief description of the Field.
+          &quot;field&quot;: &quot;A String&quot;, # Name of the Field.
+          &quot;key&quot;: True or False, # The following boolean field specifies if the current Field acts as a primary key or id if the parent is of type entity.
+          &quot;nullable&quot;: True or False, # Specifies whether a null value is allowed.
+          &quot;readonly&quot;: True or False, # Specifies if the Field is readonly.
+        },
+      ],
+    },
+  ],
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list_next">list_next(previous_request, previous_response)</code>
+  <pre>Retrieves the next page of results.
+
+Args:
+  previous_request: The request for the previous page. (required)
+  previous_response: The response from the request for the previous page. (required)
+
+Returns:
+  A request object that you can call &#x27;execute()&#x27; on to request the next
+  page. Returns None if there are no more items in the collection.
+    </pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/connectors_v1.projects.locations.global_.html b/docs/dyn/connectors_v1.projects.locations.global_.html
new file mode 100644
index 0000000..f5a4c9b
--- /dev/null
+++ b/docs/dyn/connectors_v1.projects.locations.global_.html
@@ -0,0 +1,91 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="connectors_v1.html">Connectors API</a> . <a href="connectors_v1.projects.html">projects</a> . <a href="connectors_v1.projects.locations.html">locations</a> . <a href="connectors_v1.projects.locations.global_.html">global_</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="connectors_v1.projects.locations.global_.providers.html">providers()</a></code>
+</p>
+<p class="firstline">Returns the providers Resource.</p>
+
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/connectors_v1.projects.locations.global_.providers.connectors.html b/docs/dyn/connectors_v1.projects.locations.global_.providers.connectors.html
new file mode 100644
index 0000000..c967b72
--- /dev/null
+++ b/docs/dyn/connectors_v1.projects.locations.global_.providers.connectors.html
@@ -0,0 +1,182 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="connectors_v1.html">Connectors API</a> . <a href="connectors_v1.projects.html">projects</a> . <a href="connectors_v1.projects.locations.html">locations</a> . <a href="connectors_v1.projects.locations.global_.html">global_</a> . <a href="connectors_v1.projects.locations.global_.providers.html">providers</a> . <a href="connectors_v1.projects.locations.global_.providers.connectors.html">connectors</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="connectors_v1.projects.locations.global_.providers.connectors.versions.html">versions()</a></code>
+</p>
+<p class="firstline">Returns the versions Resource.</p>
+
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets details of a single Connector.</p>
+<p class="toc_element">
+  <code><a href="#list">list(parent, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Lists Connectors in a given project and location.</p>
+<p class="toc_element">
+  <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
+<p class="firstline">Retrieves the next page of results.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="get">get(name, x__xgafv=None)</code>
+  <pre>Gets details of a single Connector.
+
+Args:
+  name: string, Required. Resource name of the form: `projects/*/locations/*/providers/*/connectors/*` (required)
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Connectors indicates a specific connector type, e.x. Salesforce, SAP etc.
+  &quot;createTime&quot;: &quot;A String&quot;, # Output only. Created time.
+  &quot;description&quot;: &quot;A String&quot;, # Output only. Description of the resource.
+  &quot;displayName&quot;: &quot;A String&quot;, # Output only. Display name.
+  &quot;documentationUri&quot;: &quot;A String&quot;, # Output only. Link to documentation page.
+  &quot;externalUri&quot;: &quot;A String&quot;, # Output only. Link to external page.
+  &quot;labels&quot;: { # Output only. Resource labels to represent user-provided metadata. Refer to cloud documentation on labels for more details. https://cloud.google.com/compute/docs/labeling-resources
+    &quot;a_key&quot;: &quot;A String&quot;,
+  },
+  &quot;name&quot;: &quot;A String&quot;, # Output only. Resource name of the Connector. Format: projects/{project}/locations/{location}/providers/{provider}/connectors/{connector}
+  &quot;updateTime&quot;: &quot;A String&quot;, # Output only. Updated time.
+  &quot;webAssetsLocation&quot;: &quot;A String&quot;, # Output only. Cloud storage location of icons etc consumed by UI.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list">list(parent, pageSize=None, pageToken=None, x__xgafv=None)</code>
+  <pre>Lists Connectors in a given project and location.
+
+Args:
+  parent: string, Required. Parent resource of the connectors, of the form: `projects/*/locations/*/providers/*` (required)
+  pageSize: integer, Page size.
+  pageToken: string, Page token.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Response message for Connectors.ListConnectors.
+  &quot;connectors&quot;: [ # A list of connectors.
+    { # Connectors indicates a specific connector type, e.x. Salesforce, SAP etc.
+      &quot;createTime&quot;: &quot;A String&quot;, # Output only. Created time.
+      &quot;description&quot;: &quot;A String&quot;, # Output only. Description of the resource.
+      &quot;displayName&quot;: &quot;A String&quot;, # Output only. Display name.
+      &quot;documentationUri&quot;: &quot;A String&quot;, # Output only. Link to documentation page.
+      &quot;externalUri&quot;: &quot;A String&quot;, # Output only. Link to external page.
+      &quot;labels&quot;: { # Output only. Resource labels to represent user-provided metadata. Refer to cloud documentation on labels for more details. https://cloud.google.com/compute/docs/labeling-resources
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+      &quot;name&quot;: &quot;A String&quot;, # Output only. Resource name of the Connector. Format: projects/{project}/locations/{location}/providers/{provider}/connectors/{connector}
+      &quot;updateTime&quot;: &quot;A String&quot;, # Output only. Updated time.
+      &quot;webAssetsLocation&quot;: &quot;A String&quot;, # Output only. Cloud storage location of icons etc consumed by UI.
+    },
+  ],
+  &quot;nextPageToken&quot;: &quot;A String&quot;, # Next page token.
+  &quot;unreachable&quot;: [ # Locations that could not be reached.
+    &quot;A String&quot;,
+  ],
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list_next">list_next(previous_request, previous_response)</code>
+  <pre>Retrieves the next page of results.
+
+Args:
+  previous_request: The request for the previous page. (required)
+  previous_response: The response from the request for the previous page. (required)
+
+Returns:
+  A request object that you can call &#x27;execute()&#x27; on to request the next
+  page. Returns None if there are no more items in the collection.
+    </pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/connectors_v1.projects.locations.global_.providers.connectors.versions.html b/docs/dyn/connectors_v1.projects.locations.global_.providers.connectors.versions.html
new file mode 100644
index 0000000..4ae5b6e
--- /dev/null
+++ b/docs/dyn/connectors_v1.projects.locations.global_.providers.connectors.versions.html
@@ -0,0 +1,363 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="connectors_v1.html">Connectors API</a> . <a href="connectors_v1.projects.html">projects</a> . <a href="connectors_v1.projects.locations.html">locations</a> . <a href="connectors_v1.projects.locations.global_.html">global_</a> . <a href="connectors_v1.projects.locations.global_.providers.html">providers</a> . <a href="connectors_v1.projects.locations.global_.providers.connectors.html">connectors</a> . <a href="connectors_v1.projects.locations.global_.providers.connectors.versions.html">versions</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#get">get(name, view=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets details of a single connector version.</p>
+<p class="toc_element">
+  <code><a href="#list">list(parent, pageSize=None, pageToken=None, view=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Lists Connector Versions in a given project and location.</p>
+<p class="toc_element">
+  <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
+<p class="firstline">Retrieves the next page of results.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="get">get(name, view=None, x__xgafv=None)</code>
+  <pre>Gets details of a single connector version.
+
+Args:
+  name: string, Required. Resource name of the form: `projects/*/locations/*/providers/*/connectors/*/versions/*` (required)
+  view: string, Specifies which fields of the ConnectorVersion are returned in the response. Defaults to `CUSTOMER` view.
+    Allowed values
+      CONNECTOR_VERSION_VIEW_UNSPECIFIED - CONNECTOR_VERSION_VIEW_UNSPECIFIED.
+      CONNECTOR_VERSION_VIEW_BASIC - Do not include role grant configs.
+      CONNECTOR_VERSION_VIEW_FULL - Include role grant configs.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # ConnectorVersion indicates a specific version of a connector.
+  &quot;authConfigTemplates&quot;: [ # Output only. List of auth configs supported by the Connector Version.
+    { # AuthConfigTemplate defines required field over an authentication type.
+      &quot;authType&quot;: &quot;A String&quot;, # The type of authentication configured.
+      &quot;configVariableTemplates&quot;: [ # Config variables to describe an `AuthConfig` for a `Connection`.
+        { # ConfigVariableTemplate provides metadata about a `ConfigVariable` that is used in a Connection.
+          &quot;description&quot;: &quot;A String&quot;, # Description.
+          &quot;displayName&quot;: &quot;A String&quot;, # Display name of the parameter.
+          &quot;key&quot;: &quot;A String&quot;, # Key of the config variable.
+          &quot;required&quot;: True or False, # Flag represents that this `ConfigVariable` must be provided for a connection.
+          &quot;roleGrant&quot;: { # This configuration defines all the Cloud IAM roles that needs to be granted to a particular GCP resource for the selected prinicpal like service account. These configurations will let UI display to customers what IAM roles need to be granted by them. Or these configurations can be used by the UI to render a &#x27;grant&#x27; button to do the same on behalf of the user. # Role grant configuration for the config variable.
+            &quot;helperTextTemplate&quot;: &quot;A String&quot;, # Template that UI can use to provide helper text to customers.
+            &quot;principal&quot;: &quot;A String&quot;, # Prinicipal/Identity for whom the role need to assigned.
+            &quot;resource&quot;: { # Resource definition # Resource on which the roles needs to be granted for the principal.
+              &quot;pathTemplate&quot;: &quot;A String&quot;, # Template to uniquely represent a GCP resource in a format IAM expects This is a template that can have references to other values provided in the config variable template.
+              &quot;type&quot;: &quot;A String&quot;, # Different types of resource supported.
+            },
+            &quot;roles&quot;: [ # List of roles that need to be granted.
+              &quot;A String&quot;,
+            ],
+          },
+          &quot;validationRegex&quot;: &quot;A String&quot;, # Regular expression in RE2 syntax used for validating the `value` of a `ConfigVariable`.
+          &quot;valueType&quot;: &quot;A String&quot;, # Type of the parameter: string, int, bool etc. consider custom type for the benefit for the validation.
+        },
+      ],
+    },
+  ],
+  &quot;configVariableTemplates&quot;: [ # Output only. List of config variables needed to create a connection.
+    { # ConfigVariableTemplate provides metadata about a `ConfigVariable` that is used in a Connection.
+      &quot;description&quot;: &quot;A String&quot;, # Description.
+      &quot;displayName&quot;: &quot;A String&quot;, # Display name of the parameter.
+      &quot;key&quot;: &quot;A String&quot;, # Key of the config variable.
+      &quot;required&quot;: True or False, # Flag represents that this `ConfigVariable` must be provided for a connection.
+      &quot;roleGrant&quot;: { # This configuration defines all the Cloud IAM roles that needs to be granted to a particular GCP resource for the selected prinicpal like service account. These configurations will let UI display to customers what IAM roles need to be granted by them. Or these configurations can be used by the UI to render a &#x27;grant&#x27; button to do the same on behalf of the user. # Role grant configuration for the config variable.
+        &quot;helperTextTemplate&quot;: &quot;A String&quot;, # Template that UI can use to provide helper text to customers.
+        &quot;principal&quot;: &quot;A String&quot;, # Prinicipal/Identity for whom the role need to assigned.
+        &quot;resource&quot;: { # Resource definition # Resource on which the roles needs to be granted for the principal.
+          &quot;pathTemplate&quot;: &quot;A String&quot;, # Template to uniquely represent a GCP resource in a format IAM expects This is a template that can have references to other values provided in the config variable template.
+          &quot;type&quot;: &quot;A String&quot;, # Different types of resource supported.
+        },
+        &quot;roles&quot;: [ # List of roles that need to be granted.
+          &quot;A String&quot;,
+        ],
+      },
+      &quot;validationRegex&quot;: &quot;A String&quot;, # Regular expression in RE2 syntax used for validating the `value` of a `ConfigVariable`.
+      &quot;valueType&quot;: &quot;A String&quot;, # Type of the parameter: string, int, bool etc. consider custom type for the benefit for the validation.
+    },
+  ],
+  &quot;createTime&quot;: &quot;A String&quot;, # Output only. Created time.
+  &quot;displayName&quot;: &quot;A String&quot;, # Output only. Display name.
+  &quot;egressControlConfig&quot;: { # Egress control config for connector runtime. These configurations define the rules to identify which outbound domains/hosts needs to be whitelisted. It may be a static information for a particular connector version or it is derived from the configurations provided by the customer in Connection resource. # Output only. Configuration for Egress Control.
+    &quot;backends&quot;: &quot;A String&quot;, # Static Comma separated backends which are common for all Connection resources. Supported formats for each backend are host:port or just host (host can be ip address or domain name).
+    &quot;extractionRules&quot;: { # Extraction Rules to identity the backends from customer provided configuration in Connection resource. # Extractions Rules to extract the backends from customer provided configuration.
+      &quot;extractionRule&quot;: [ # Collection of Extraction Rule.
+        { # Extraction Rule.
+          &quot;extractionRegex&quot;: &quot;A String&quot;, # Regex used to extract backend details from source. If empty, whole source value will be used.
+          &quot;source&quot;: { # Source to extract the backend from. # Source on which the rule is applied.
+            &quot;fieldId&quot;: &quot;A String&quot;, # Field identifier. For example config vaiable name.
+            &quot;sourceType&quot;: &quot;A String&quot;, # Type of the source.
+          },
+        },
+      ],
+    },
+  },
+  &quot;labels&quot;: { # Output only. Resource labels to represent user-provided metadata. Refer to cloud documentation on labels for more details. https://cloud.google.com/compute/docs/labeling-resources
+    &quot;a_key&quot;: &quot;A String&quot;,
+  },
+  &quot;launchStage&quot;: &quot;A String&quot;, # Output only. Flag to mark the version indicating the launch stage.
+  &quot;name&quot;: &quot;A String&quot;, # Output only. Resource name of the Version. Format: projects/{project}/locations/{location}/providers/{provider}/connectors/{connector}/versions/{version}
+  &quot;releaseVersion&quot;: &quot;A String&quot;, # Output only. ReleaseVersion of the connector, for example: &quot;1.0.1-alpha&quot;.
+  &quot;roleGrant&quot;: { # This configuration defines all the Cloud IAM roles that needs to be granted to a particular GCP resource for the selected prinicpal like service account. These configurations will let UI display to customers what IAM roles need to be granted by them. Or these configurations can be used by the UI to render a &#x27;grant&#x27; button to do the same on behalf of the user. # Output only. Role grant configuration for this config variable. It will be DEPRECATED soon.
+    &quot;helperTextTemplate&quot;: &quot;A String&quot;, # Template that UI can use to provide helper text to customers.
+    &quot;principal&quot;: &quot;A String&quot;, # Prinicipal/Identity for whom the role need to assigned.
+    &quot;resource&quot;: { # Resource definition # Resource on which the roles needs to be granted for the principal.
+      &quot;pathTemplate&quot;: &quot;A String&quot;, # Template to uniquely represent a GCP resource in a format IAM expects This is a template that can have references to other values provided in the config variable template.
+      &quot;type&quot;: &quot;A String&quot;, # Different types of resource supported.
+    },
+    &quot;roles&quot;: [ # List of roles that need to be granted.
+      &quot;A String&quot;,
+    ],
+  },
+  &quot;roleGrants&quot;: [ # Output only. Role grant configurations for this connector version.
+    { # This configuration defines all the Cloud IAM roles that needs to be granted to a particular GCP resource for the selected prinicpal like service account. These configurations will let UI display to customers what IAM roles need to be granted by them. Or these configurations can be used by the UI to render a &#x27;grant&#x27; button to do the same on behalf of the user.
+      &quot;helperTextTemplate&quot;: &quot;A String&quot;, # Template that UI can use to provide helper text to customers.
+      &quot;principal&quot;: &quot;A String&quot;, # Prinicipal/Identity for whom the role need to assigned.
+      &quot;resource&quot;: { # Resource definition # Resource on which the roles needs to be granted for the principal.
+        &quot;pathTemplate&quot;: &quot;A String&quot;, # Template to uniquely represent a GCP resource in a format IAM expects This is a template that can have references to other values provided in the config variable template.
+        &quot;type&quot;: &quot;A String&quot;, # Different types of resource supported.
+      },
+      &quot;roles&quot;: [ # List of roles that need to be granted.
+        &quot;A String&quot;,
+      ],
+    },
+  ],
+  &quot;supportedRuntimeFeatures&quot;: { # Supported runtime features of a connector version. This is passed to the management layer to add a new connector version by the connector developer. Details about how this proto is passed to the management layer is covered in this doc - go/runtime-manifest. # Output only. Information about the runtime features supported by the Connector.
+    &quot;actionApis&quot;: True or False, # Specifies if the connector supports action apis like &#x27;executeAction&#x27;.
+    &quot;entityApis&quot;: True or False, # Specifies if the connector supports entity apis like &#x27;createEntity&#x27;.
+    &quot;sqlQuery&quot;: True or False, # Specifies if the connector supports &#x27;ExecuteSqlQuery&#x27; operation.
+  },
+  &quot;updateTime&quot;: &quot;A String&quot;, # Output only. Updated time.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list">list(parent, pageSize=None, pageToken=None, view=None, x__xgafv=None)</code>
+  <pre>Lists Connector Versions in a given project and location.
+
+Args:
+  parent: string, Required. Parent resource of the connectors, of the form: `projects/*/locations/*/providers/*/connectors/*` (required)
+  pageSize: integer, Page size.
+  pageToken: string, Page token.
+  view: string, Specifies which fields of the ConnectorVersion are returned in the response. Defaults to `CUSTOMER` view.
+    Allowed values
+      CONNECTOR_VERSION_VIEW_UNSPECIFIED - CONNECTOR_VERSION_VIEW_UNSPECIFIED.
+      CONNECTOR_VERSION_VIEW_BASIC - Do not include role grant configs.
+      CONNECTOR_VERSION_VIEW_FULL - Include role grant configs.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Response message for Connectors.ListConnectorVersions.
+  &quot;connectorVersions&quot;: [ # A list of connector versions.
+    { # ConnectorVersion indicates a specific version of a connector.
+      &quot;authConfigTemplates&quot;: [ # Output only. List of auth configs supported by the Connector Version.
+        { # AuthConfigTemplate defines required field over an authentication type.
+          &quot;authType&quot;: &quot;A String&quot;, # The type of authentication configured.
+          &quot;configVariableTemplates&quot;: [ # Config variables to describe an `AuthConfig` for a `Connection`.
+            { # ConfigVariableTemplate provides metadata about a `ConfigVariable` that is used in a Connection.
+              &quot;description&quot;: &quot;A String&quot;, # Description.
+              &quot;displayName&quot;: &quot;A String&quot;, # Display name of the parameter.
+              &quot;key&quot;: &quot;A String&quot;, # Key of the config variable.
+              &quot;required&quot;: True or False, # Flag represents that this `ConfigVariable` must be provided for a connection.
+              &quot;roleGrant&quot;: { # This configuration defines all the Cloud IAM roles that needs to be granted to a particular GCP resource for the selected prinicpal like service account. These configurations will let UI display to customers what IAM roles need to be granted by them. Or these configurations can be used by the UI to render a &#x27;grant&#x27; button to do the same on behalf of the user. # Role grant configuration for the config variable.
+                &quot;helperTextTemplate&quot;: &quot;A String&quot;, # Template that UI can use to provide helper text to customers.
+                &quot;principal&quot;: &quot;A String&quot;, # Prinicipal/Identity for whom the role need to assigned.
+                &quot;resource&quot;: { # Resource definition # Resource on which the roles needs to be granted for the principal.
+                  &quot;pathTemplate&quot;: &quot;A String&quot;, # Template to uniquely represent a GCP resource in a format IAM expects This is a template that can have references to other values provided in the config variable template.
+                  &quot;type&quot;: &quot;A String&quot;, # Different types of resource supported.
+                },
+                &quot;roles&quot;: [ # List of roles that need to be granted.
+                  &quot;A String&quot;,
+                ],
+              },
+              &quot;validationRegex&quot;: &quot;A String&quot;, # Regular expression in RE2 syntax used for validating the `value` of a `ConfigVariable`.
+              &quot;valueType&quot;: &quot;A String&quot;, # Type of the parameter: string, int, bool etc. consider custom type for the benefit for the validation.
+            },
+          ],
+        },
+      ],
+      &quot;configVariableTemplates&quot;: [ # Output only. List of config variables needed to create a connection.
+        { # ConfigVariableTemplate provides metadata about a `ConfigVariable` that is used in a Connection.
+          &quot;description&quot;: &quot;A String&quot;, # Description.
+          &quot;displayName&quot;: &quot;A String&quot;, # Display name of the parameter.
+          &quot;key&quot;: &quot;A String&quot;, # Key of the config variable.
+          &quot;required&quot;: True or False, # Flag represents that this `ConfigVariable` must be provided for a connection.
+          &quot;roleGrant&quot;: { # This configuration defines all the Cloud IAM roles that needs to be granted to a particular GCP resource for the selected prinicpal like service account. These configurations will let UI display to customers what IAM roles need to be granted by them. Or these configurations can be used by the UI to render a &#x27;grant&#x27; button to do the same on behalf of the user. # Role grant configuration for the config variable.
+            &quot;helperTextTemplate&quot;: &quot;A String&quot;, # Template that UI can use to provide helper text to customers.
+            &quot;principal&quot;: &quot;A String&quot;, # Prinicipal/Identity for whom the role need to assigned.
+            &quot;resource&quot;: { # Resource definition # Resource on which the roles needs to be granted for the principal.
+              &quot;pathTemplate&quot;: &quot;A String&quot;, # Template to uniquely represent a GCP resource in a format IAM expects This is a template that can have references to other values provided in the config variable template.
+              &quot;type&quot;: &quot;A String&quot;, # Different types of resource supported.
+            },
+            &quot;roles&quot;: [ # List of roles that need to be granted.
+              &quot;A String&quot;,
+            ],
+          },
+          &quot;validationRegex&quot;: &quot;A String&quot;, # Regular expression in RE2 syntax used for validating the `value` of a `ConfigVariable`.
+          &quot;valueType&quot;: &quot;A String&quot;, # Type of the parameter: string, int, bool etc. consider custom type for the benefit for the validation.
+        },
+      ],
+      &quot;createTime&quot;: &quot;A String&quot;, # Output only. Created time.
+      &quot;displayName&quot;: &quot;A String&quot;, # Output only. Display name.
+      &quot;egressControlConfig&quot;: { # Egress control config for connector runtime. These configurations define the rules to identify which outbound domains/hosts needs to be whitelisted. It may be a static information for a particular connector version or it is derived from the configurations provided by the customer in Connection resource. # Output only. Configuration for Egress Control.
+        &quot;backends&quot;: &quot;A String&quot;, # Static Comma separated backends which are common for all Connection resources. Supported formats for each backend are host:port or just host (host can be ip address or domain name).
+        &quot;extractionRules&quot;: { # Extraction Rules to identity the backends from customer provided configuration in Connection resource. # Extractions Rules to extract the backends from customer provided configuration.
+          &quot;extractionRule&quot;: [ # Collection of Extraction Rule.
+            { # Extraction Rule.
+              &quot;extractionRegex&quot;: &quot;A String&quot;, # Regex used to extract backend details from source. If empty, whole source value will be used.
+              &quot;source&quot;: { # Source to extract the backend from. # Source on which the rule is applied.
+                &quot;fieldId&quot;: &quot;A String&quot;, # Field identifier. For example config vaiable name.
+                &quot;sourceType&quot;: &quot;A String&quot;, # Type of the source.
+              },
+            },
+          ],
+        },
+      },
+      &quot;labels&quot;: { # Output only. Resource labels to represent user-provided metadata. Refer to cloud documentation on labels for more details. https://cloud.google.com/compute/docs/labeling-resources
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+      &quot;launchStage&quot;: &quot;A String&quot;, # Output only. Flag to mark the version indicating the launch stage.
+      &quot;name&quot;: &quot;A String&quot;, # Output only. Resource name of the Version. Format: projects/{project}/locations/{location}/providers/{provider}/connectors/{connector}/versions/{version}
+      &quot;releaseVersion&quot;: &quot;A String&quot;, # Output only. ReleaseVersion of the connector, for example: &quot;1.0.1-alpha&quot;.
+      &quot;roleGrant&quot;: { # This configuration defines all the Cloud IAM roles that needs to be granted to a particular GCP resource for the selected prinicpal like service account. These configurations will let UI display to customers what IAM roles need to be granted by them. Or these configurations can be used by the UI to render a &#x27;grant&#x27; button to do the same on behalf of the user. # Output only. Role grant configuration for this config variable. It will be DEPRECATED soon.
+        &quot;helperTextTemplate&quot;: &quot;A String&quot;, # Template that UI can use to provide helper text to customers.
+        &quot;principal&quot;: &quot;A String&quot;, # Prinicipal/Identity for whom the role need to assigned.
+        &quot;resource&quot;: { # Resource definition # Resource on which the roles needs to be granted for the principal.
+          &quot;pathTemplate&quot;: &quot;A String&quot;, # Template to uniquely represent a GCP resource in a format IAM expects This is a template that can have references to other values provided in the config variable template.
+          &quot;type&quot;: &quot;A String&quot;, # Different types of resource supported.
+        },
+        &quot;roles&quot;: [ # List of roles that need to be granted.
+          &quot;A String&quot;,
+        ],
+      },
+      &quot;roleGrants&quot;: [ # Output only. Role grant configurations for this connector version.
+        { # This configuration defines all the Cloud IAM roles that needs to be granted to a particular GCP resource for the selected prinicpal like service account. These configurations will let UI display to customers what IAM roles need to be granted by them. Or these configurations can be used by the UI to render a &#x27;grant&#x27; button to do the same on behalf of the user.
+          &quot;helperTextTemplate&quot;: &quot;A String&quot;, # Template that UI can use to provide helper text to customers.
+          &quot;principal&quot;: &quot;A String&quot;, # Prinicipal/Identity for whom the role need to assigned.
+          &quot;resource&quot;: { # Resource definition # Resource on which the roles needs to be granted for the principal.
+            &quot;pathTemplate&quot;: &quot;A String&quot;, # Template to uniquely represent a GCP resource in a format IAM expects This is a template that can have references to other values provided in the config variable template.
+            &quot;type&quot;: &quot;A String&quot;, # Different types of resource supported.
+          },
+          &quot;roles&quot;: [ # List of roles that need to be granted.
+            &quot;A String&quot;,
+          ],
+        },
+      ],
+      &quot;supportedRuntimeFeatures&quot;: { # Supported runtime features of a connector version. This is passed to the management layer to add a new connector version by the connector developer. Details about how this proto is passed to the management layer is covered in this doc - go/runtime-manifest. # Output only. Information about the runtime features supported by the Connector.
+        &quot;actionApis&quot;: True or False, # Specifies if the connector supports action apis like &#x27;executeAction&#x27;.
+        &quot;entityApis&quot;: True or False, # Specifies if the connector supports entity apis like &#x27;createEntity&#x27;.
+        &quot;sqlQuery&quot;: True or False, # Specifies if the connector supports &#x27;ExecuteSqlQuery&#x27; operation.
+      },
+      &quot;updateTime&quot;: &quot;A String&quot;, # Output only. Updated time.
+    },
+  ],
+  &quot;nextPageToken&quot;: &quot;A String&quot;, # Next page token.
+  &quot;unreachable&quot;: [ # Locations that could not be reached.
+    &quot;A String&quot;,
+  ],
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list_next">list_next(previous_request, previous_response)</code>
+  <pre>Retrieves the next page of results.
+
+Args:
+  previous_request: The request for the previous page. (required)
+  previous_response: The response from the request for the previous page. (required)
+
+Returns:
+  A request object that you can call &#x27;execute()&#x27; on to request the next
+  page. Returns None if there are no more items in the collection.
+    </pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/connectors_v1.projects.locations.global_.providers.html b/docs/dyn/connectors_v1.projects.locations.global_.providers.html
new file mode 100644
index 0000000..4511566
--- /dev/null
+++ b/docs/dyn/connectors_v1.projects.locations.global_.providers.html
@@ -0,0 +1,182 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="connectors_v1.html">Connectors API</a> . <a href="connectors_v1.projects.html">projects</a> . <a href="connectors_v1.projects.locations.html">locations</a> . <a href="connectors_v1.projects.locations.global_.html">global_</a> . <a href="connectors_v1.projects.locations.global_.providers.html">providers</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="connectors_v1.projects.locations.global_.providers.connectors.html">connectors()</a></code>
+</p>
+<p class="firstline">Returns the connectors Resource.</p>
+
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets details of a single Provider.</p>
+<p class="toc_element">
+  <code><a href="#list">list(parent, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Lists Providers in a given project and location.</p>
+<p class="toc_element">
+  <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
+<p class="firstline">Retrieves the next page of results.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="get">get(name, x__xgafv=None)</code>
+  <pre>Gets details of a single Provider.
+
+Args:
+  name: string, Required. Resource name of the form: `projects/*/locations/*/providers/*` (required)
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Provider indicates the owner who provides the connectors.
+  &quot;createTime&quot;: &quot;A String&quot;, # Output only. Created time.
+  &quot;description&quot;: &quot;A String&quot;, # Output only. Description of the resource.
+  &quot;displayName&quot;: &quot;A String&quot;, # Output only. Display name.
+  &quot;documentationUri&quot;: &quot;A String&quot;, # Output only. Link to documentation page.
+  &quot;externalUri&quot;: &quot;A String&quot;, # Output only. Link to external page.
+  &quot;labels&quot;: { # Output only. Resource labels to represent user-provided metadata. Refer to cloud documentation on labels for more details. https://cloud.google.com/compute/docs/labeling-resources
+    &quot;a_key&quot;: &quot;A String&quot;,
+  },
+  &quot;name&quot;: &quot;A String&quot;, # Output only. Resource name of the Provider. Format: projects/{project}/locations/{location}/providers/{provider}
+  &quot;updateTime&quot;: &quot;A String&quot;, # Output only. Updated time.
+  &quot;webAssetsLocation&quot;: &quot;A String&quot;, # Output only. Cloud storage location of icons etc consumed by UI.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list">list(parent, pageSize=None, pageToken=None, x__xgafv=None)</code>
+  <pre>Lists Providers in a given project and location.
+
+Args:
+  parent: string, Required. Parent resource of the API, of the form: `projects/*/locations/*` (required)
+  pageSize: integer, Page size.
+  pageToken: string, Page token.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Response message for Connectors.ListProviders.
+  &quot;nextPageToken&quot;: &quot;A String&quot;, # Next page token.
+  &quot;providers&quot;: [ # A list of providers.
+    { # Provider indicates the owner who provides the connectors.
+      &quot;createTime&quot;: &quot;A String&quot;, # Output only. Created time.
+      &quot;description&quot;: &quot;A String&quot;, # Output only. Description of the resource.
+      &quot;displayName&quot;: &quot;A String&quot;, # Output only. Display name.
+      &quot;documentationUri&quot;: &quot;A String&quot;, # Output only. Link to documentation page.
+      &quot;externalUri&quot;: &quot;A String&quot;, # Output only. Link to external page.
+      &quot;labels&quot;: { # Output only. Resource labels to represent user-provided metadata. Refer to cloud documentation on labels for more details. https://cloud.google.com/compute/docs/labeling-resources
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+      &quot;name&quot;: &quot;A String&quot;, # Output only. Resource name of the Provider. Format: projects/{project}/locations/{location}/providers/{provider}
+      &quot;updateTime&quot;: &quot;A String&quot;, # Output only. Updated time.
+      &quot;webAssetsLocation&quot;: &quot;A String&quot;, # Output only. Cloud storage location of icons etc consumed by UI.
+    },
+  ],
+  &quot;unreachable&quot;: [ # Locations that could not be reached.
+    &quot;A String&quot;,
+  ],
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list_next">list_next(previous_request, previous_response)</code>
+  <pre>Retrieves the next page of results.
+
+Args:
+  previous_request: The request for the previous page. (required)
+  previous_response: The response from the request for the previous page. (required)
+
+Returns:
+  A request object that you can call &#x27;execute()&#x27; on to request the next
+  page. Returns None if there are no more items in the collection.
+    </pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/connectors_v1.projects.locations.html b/docs/dyn/connectors_v1.projects.locations.html
new file mode 100644
index 0000000..e93f48c
--- /dev/null
+++ b/docs/dyn/connectors_v1.projects.locations.html
@@ -0,0 +1,221 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="connectors_v1.html">Connectors API</a> . <a href="connectors_v1.projects.html">projects</a> . <a href="connectors_v1.projects.locations.html">locations</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="connectors_v1.projects.locations.connections.html">connections()</a></code>
+</p>
+<p class="firstline">Returns the connections Resource.</p>
+
+<p class="toc_element">
+  <code><a href="connectors_v1.projects.locations.global_.html">global_()</a></code>
+</p>
+<p class="firstline">Returns the global_ Resource.</p>
+
+<p class="toc_element">
+  <code><a href="connectors_v1.projects.locations.operations.html">operations()</a></code>
+</p>
+<p class="firstline">Returns the operations Resource.</p>
+
+<p class="toc_element">
+  <code><a href="connectors_v1.projects.locations.providers.html">providers()</a></code>
+</p>
+<p class="firstline">Returns the providers Resource.</p>
+
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets information about a location.</p>
+<p class="toc_element">
+  <code><a href="#getRuntimeConfig">getRuntimeConfig(name, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets the runtimeConfig of a location. RuntimeConfig is a singleton resource for each location.</p>
+<p class="toc_element">
+  <code><a href="#list">list(name, filter=None, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Lists information about the supported locations for this service.</p>
+<p class="toc_element">
+  <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
+<p class="firstline">Retrieves the next page of results.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="get">get(name, x__xgafv=None)</code>
+  <pre>Gets information about a location.
+
+Args:
+  name: string, Resource name for the location. (required)
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # A resource that represents Google Cloud Platform location.
+  &quot;displayName&quot;: &quot;A String&quot;, # The friendly name for this location, typically a nearby city name. For example, &quot;Tokyo&quot;.
+  &quot;labels&quot;: { # Cross-service attributes for the location. For example {&quot;cloud.googleapis.com/region&quot;: &quot;us-east1&quot;}
+    &quot;a_key&quot;: &quot;A String&quot;,
+  },
+  &quot;locationId&quot;: &quot;A String&quot;, # The canonical id for this location. For example: `&quot;us-east1&quot;`.
+  &quot;metadata&quot;: { # Service-specific metadata. For example the available capacity at the given location.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # Resource name for the location, which may vary between implementations. For example: `&quot;projects/example-project/locations/us-east1&quot;`
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="getRuntimeConfig">getRuntimeConfig(name, x__xgafv=None)</code>
+  <pre>Gets the runtimeConfig of a location. RuntimeConfig is a singleton resource for each location.
+
+Args:
+  name: string, Required. Resource name of the form: `projects/*/locations/*/runtimeConfig` (required)
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # RuntimeConfig is the singleton resource of each location. It includes generic resource configs consumed by control plane and runtime plane like: pub/sub topic/subscription resource name, Cloud Storage location storing schema etc.
+  &quot;conndSubscription&quot;: &quot;A String&quot;, # Output only. Pub/Sub subscription for connd to receive message. E.g. projects/{project-id}/subscriptions/{topic-id}
+  &quot;conndTopic&quot;: &quot;A String&quot;, # Output only. Pub/Sub topic for connd to send message. E.g. projects/{project-id}/topics/{topic-id}
+  &quot;controlPlaneSubscription&quot;: &quot;A String&quot;, # Output only. Pub/Sub subscription for control plane to receive message. E.g. projects/{project-id}/subscriptions/{topic-id}
+  &quot;controlPlaneTopic&quot;: &quot;A String&quot;, # Output only. Pub/Sub topic for control plne to send message. communication. E.g. projects/{project-id}/topics/{topic-id}
+  &quot;locationId&quot;: &quot;A String&quot;, # Output only. location_id of the runtime location. E.g. &quot;us-west1&quot;.
+  &quot;runtimeEndpoint&quot;: &quot;A String&quot;, # Output only. The endpoint of the connectors runtime ingress.
+  &quot;schemaGcsBucket&quot;: &quot;A String&quot;, # Output only. The Cloud Storage bucket that stores connector&#x27;s schema reports.
+  &quot;serviceDirectory&quot;: &quot;A String&quot;, # Output only. The name of the Service Directory service name. Used for Private Harpoon to resolve the ILB address. e.g. &quot;projects/cloud-connectors-e2e-testing/locations/us-central1/namespaces/istio-system/services/istio-ingressgateway-connectors&quot;
+  &quot;state&quot;: &quot;A String&quot;, # Output only. The state of the location.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list">list(name, filter=None, pageSize=None, pageToken=None, x__xgafv=None)</code>
+  <pre>Lists information about the supported locations for this service.
+
+Args:
+  name: string, The resource that owns the locations collection, if applicable. (required)
+  filter: string, A filter to narrow down results to a preferred subset. The filtering language accepts strings like &quot;displayName=tokyo&quot;, and is documented in more detail in [AIP-160](https://google.aip.dev/160).
+  pageSize: integer, The maximum number of results to return. If not set, the service selects a default.
+  pageToken: string, A page token received from the `next_page_token` field in the response. Send that page token to receive the subsequent page.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # The response message for Locations.ListLocations.
+  &quot;locations&quot;: [ # A list of locations that matches the specified filter in the request.
+    { # A resource that represents Google Cloud Platform location.
+      &quot;displayName&quot;: &quot;A String&quot;, # The friendly name for this location, typically a nearby city name. For example, &quot;Tokyo&quot;.
+      &quot;labels&quot;: { # Cross-service attributes for the location. For example {&quot;cloud.googleapis.com/region&quot;: &quot;us-east1&quot;}
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+      &quot;locationId&quot;: &quot;A String&quot;, # The canonical id for this location. For example: `&quot;us-east1&quot;`.
+      &quot;metadata&quot;: { # Service-specific metadata. For example the available capacity at the given location.
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+      &quot;name&quot;: &quot;A String&quot;, # Resource name for the location, which may vary between implementations. For example: `&quot;projects/example-project/locations/us-east1&quot;`
+    },
+  ],
+  &quot;nextPageToken&quot;: &quot;A String&quot;, # The standard List next-page token.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list_next">list_next(previous_request, previous_response)</code>
+  <pre>Retrieves the next page of results.
+
+Args:
+  previous_request: The request for the previous page. (required)
+  previous_response: The response from the request for the previous page. (required)
+
+Returns:
+  A request object that you can call &#x27;execute()&#x27; on to request the next
+  page. Returns None if there are no more items in the collection.
+    </pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/connectors_v1.projects.locations.operations.html b/docs/dyn/connectors_v1.projects.locations.operations.html
new file mode 100644
index 0000000..f17eea3
--- /dev/null
+++ b/docs/dyn/connectors_v1.projects.locations.operations.html
@@ -0,0 +1,235 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="connectors_v1.html">Connectors API</a> . <a href="connectors_v1.projects.html">projects</a> . <a href="connectors_v1.projects.locations.html">locations</a> . <a href="connectors_v1.projects.locations.operations.html">operations</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="#cancel">cancel(name, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Starts asynchronous cancellation on a long-running operation. The server makes a best effort to cancel the operation, but success is not guaranteed. If the server doesn't support this method, it returns `google.rpc.Code.UNIMPLEMENTED`. Clients can use Operations.GetOperation or other methods to check whether the cancellation succeeded or whether the operation completed despite cancellation. On successful cancellation, the operation is not deleted; instead, it becomes an operation with an Operation.error value with a google.rpc.Status.code of 1, corresponding to `Code.CANCELLED`.</p>
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>
+<p class="firstline">Deletes a long-running operation. This method indicates that the client is no longer interested in the operation result. It does not cancel the operation. If the server doesn't support this method, it returns `google.rpc.Code.UNIMPLEMENTED`.</p>
+<p class="toc_element">
+  <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets the latest state of a long-running operation. Clients can use this method to poll the operation result at intervals as recommended by the API service.</p>
+<p class="toc_element">
+  <code><a href="#list">list(name, filter=None, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Lists operations that match the specified filter in the request. If the server doesn't support this method, it returns `UNIMPLEMENTED`. NOTE: the `name` binding allows API services to override the binding to use different resource name schemes, such as `users/*/operations`. To override the binding, API services can add a binding such as `"/v1/{name=users/*}/operations"` to their service configuration. For backwards compatibility, the default name includes the operations collection id, however overriding users must ensure the name binding is the parent resource, without the operations collection id.</p>
+<p class="toc_element">
+  <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
+<p class="firstline">Retrieves the next page of results.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="cancel">cancel(name, body=None, x__xgafv=None)</code>
+  <pre>Starts asynchronous cancellation on a long-running operation. The server makes a best effort to cancel the operation, but success is not guaranteed. If the server doesn&#x27;t support this method, it returns `google.rpc.Code.UNIMPLEMENTED`. Clients can use Operations.GetOperation or other methods to check whether the cancellation succeeded or whether the operation completed despite cancellation. On successful cancellation, the operation is not deleted; instead, it becomes an operation with an Operation.error value with a google.rpc.Status.code of 1, corresponding to `Code.CANCELLED`.
+
+Args:
+  name: string, The name of the operation resource to be cancelled. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # The request message for Operations.CancelOperation.
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); } The JSON representation for `Empty` is empty JSON object `{}`.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="delete">delete(name, x__xgafv=None)</code>
+  <pre>Deletes a long-running operation. This method indicates that the client is no longer interested in the operation result. It does not cancel the operation. If the server doesn&#x27;t support this method, it returns `google.rpc.Code.UNIMPLEMENTED`.
+
+Args:
+  name: string, The name of the operation resource to be deleted. (required)
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); } The JSON representation for `Empty` is empty JSON object `{}`.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="get">get(name, x__xgafv=None)</code>
+  <pre>Gets the latest state of a long-running operation. Clients can use this method to poll the operation result at intervals as recommended by the API service.
+
+Args:
+  name: string, The name of the operation resource. (required)
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # This resource represents a long-running operation that is the result of a network API call.
+  &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+  &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+    &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+      {
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    ],
+    &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+  },
+  &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+  &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list">list(name, filter=None, pageSize=None, pageToken=None, x__xgafv=None)</code>
+  <pre>Lists operations that match the specified filter in the request. If the server doesn&#x27;t support this method, it returns `UNIMPLEMENTED`. NOTE: the `name` binding allows API services to override the binding to use different resource name schemes, such as `users/*/operations`. To override the binding, API services can add a binding such as `&quot;/v1/{name=users/*}/operations&quot;` to their service configuration. For backwards compatibility, the default name includes the operations collection id, however overriding users must ensure the name binding is the parent resource, without the operations collection id.
+
+Args:
+  name: string, The name of the operation&#x27;s parent resource. (required)
+  filter: string, The standard list filter.
+  pageSize: integer, The standard list page size.
+  pageToken: string, The standard list page token.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # The response message for Operations.ListOperations.
+  &quot;nextPageToken&quot;: &quot;A String&quot;, # The standard List next-page token.
+  &quot;operations&quot;: [ # A list of operations that matches the specified filter in the request.
+    { # This resource represents a long-running operation that is the result of a network API call.
+      &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+      &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+        &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+        &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+          {
+            &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+          },
+        ],
+        &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+      },
+      &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+      &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+      &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    },
+  ],
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list_next">list_next(previous_request, previous_response)</code>
+  <pre>Retrieves the next page of results.
+
+Args:
+  previous_request: The request for the previous page. (required)
+  previous_response: The response from the request for the previous page. (required)
+
+Returns:
+  A request object that you can call &#x27;execute()&#x27; on to request the next
+  page. Returns None if there are no more items in the collection.
+    </pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/connectors_v1.projects.locations.providers.html b/docs/dyn/connectors_v1.projects.locations.providers.html
new file mode 100644
index 0000000..acbcaed
--- /dev/null
+++ b/docs/dyn/connectors_v1.projects.locations.providers.html
@@ -0,0 +1,258 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="connectors_v1.html">Connectors API</a> . <a href="connectors_v1.projects.html">projects</a> . <a href="connectors_v1.projects.locations.html">locations</a> . <a href="connectors_v1.projects.locations.providers.html">providers</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.</p>
+<p class="toc_element">
+  <code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.</p>
+<p class="toc_element">
+  <code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may "fail open" without warning.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</code>
+  <pre>Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.
+
+Args:
+  resource: string, REQUIRED: The resource for which the policy is being requested. See the operation documentation for the appropriate value for this field. (required)
+  options_requestedPolicyVersion: integer, Optional. The policy format version to be returned. Valid values are 0, 1, and 3. Requests specifying an invalid value will be rejected. Requests for policies with any conditional bindings must specify version 3. Policies without any conditional bindings may specify any valid value or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+  &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
+    { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
+      &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
+        { # Provides the configuration for logging a type of permissions. Example: { &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; } ] } This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting jose@example.com from DATA_READ logging.
+          &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+            &quot;A String&quot;,
+          ],
+          &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
+        },
+      ],
+      &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+    },
+  ],
+  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member. The `bindings` in a `Policy` can refer to up to 1,500 members; up to 250 of these members can be Google groups. Each occurrence of a member counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other member, then you can add another 1,450 members to the `bindings` in the `Policy`.
+    { # Associates `members` with a `role`.
+      &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+        &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+        &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
+        &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+        &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+      },
+      &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+        &quot;A String&quot;,
+      ],
+      &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+    },
+  ],
+  &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+  &quot;version&quot;: 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>
+  <pre>Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.
+
+Args:
+  resource: string, REQUIRED: The resource for which the policy is being specified. See the operation documentation for the appropriate value for this field. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Request message for `SetIamPolicy` method.
+  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+    &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
+      { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
+        &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
+          { # Provides the configuration for logging a type of permissions. Example: { &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; } ] } This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting jose@example.com from DATA_READ logging.
+            &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+              &quot;A String&quot;,
+            ],
+            &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
+          },
+        ],
+        &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+      },
+    ],
+    &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member. The `bindings` in a `Policy` can refer to up to 1,500 members; up to 250 of these members can be Google groups. Each occurrence of a member counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other member, then you can add another 1,450 members to the `bindings` in the `Policy`.
+      { # Associates `members` with a `role`.
+        &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+          &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+          &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
+          &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+          &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+        },
+        &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+          &quot;A String&quot;,
+        ],
+        &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+      },
+    ],
+    &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+    &quot;version&quot;: 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+  },
+  &quot;updateMask&quot;: &quot;A String&quot;, # OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only the fields in the mask will be modified. If no mask is provided, the following default mask is used: `paths: &quot;bindings, etag&quot;`
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+  &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
+    { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
+      &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
+        { # Provides the configuration for logging a type of permissions. Example: { &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; } ] } This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting jose@example.com from DATA_READ logging.
+          &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+            &quot;A String&quot;,
+          ],
+          &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
+        },
+      ],
+      &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+    },
+  ],
+  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member. The `bindings` in a `Policy` can refer to up to 1,500 members; up to 250 of these members can be Google groups. Each occurrence of a member counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other member, then you can add another 1,450 members to the `bindings` in the `Policy`.
+    { # Associates `members` with a `role`.
+      &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+        &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+        &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
+        &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+        &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+      },
+      &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+        &quot;A String&quot;,
+      ],
+      &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+    },
+  ],
+  &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+  &quot;version&quot;: 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>
+  <pre>Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may &quot;fail open&quot; without warning.
+
+Args:
+  resource: string, REQUIRED: The resource for which the policy detail is being requested. See the operation documentation for the appropriate value for this field. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Request message for `TestIamPermissions` method.
+  &quot;permissions&quot;: [ # The set of permissions to check for the `resource`. Permissions with wildcards (such as &#x27;*&#x27; or &#x27;storage.*&#x27;) are not allowed. For more information see [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).
+    &quot;A String&quot;,
+  ],
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Response message for `TestIamPermissions` method.
+  &quot;permissions&quot;: [ # A subset of `TestPermissionsRequest.permissions` that the caller is allowed.
+    &quot;A String&quot;,
+  ],
+}</pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/contactcenterinsights_v1.projects.locations.conversations.html b/docs/dyn/contactcenterinsights_v1.projects.locations.conversations.html
index 1cbbefa..7591b82 100644
--- a/docs/dyn/contactcenterinsights_v1.projects.locations.conversations.html
+++ b/docs/dyn/contactcenterinsights_v1.projects.locations.conversations.html
@@ -135,7 +135,7 @@
   &quot;customHighlighterMatches&quot;: { # A map associating each custom highlighter resource name with its respective number of matches in the set of conversations.
     &quot;a_key&quot;: 42,
   },
-  &quot;issueMatches&quot;: { # A map associating each issue resource name with its respective number of matches in the set of conversations. Key has the format: `projects//locations//issueModels//issues/`
+  &quot;issueMatches&quot;: { # A map associating each issue resource name with its respective number of matches in the set of conversations. Key has the format: `projects//locations//issueModels//issues/` Deprecated, use `issue_matches_stats` field instead.
     &quot;a_key&quot;: 42,
   },
   &quot;smartHighlighterMatches&quot;: { # A map associating each smart highlighter display name with its respective number of matches in the set of conversations.
@@ -346,7 +346,11 @@
       { # A segment of a full transcript.
         &quot;channelTag&quot;: 42, # For conversations derived from multi-channel audio, this is the channel number corresponding to the audio from that channel. For audioChannelCount = N, its output values can range from &#x27;1&#x27; to &#x27;N&#x27;. A channel tag of 0 indicates that the audio is mono.
         &quot;confidence&quot;: 3.14, # A confidence estimate between 0.0 and 1.0 of the fidelity of this segment. A default value of 0.0 indicates that the value is unset.
+        &quot;dialogflowSegmentMetadata&quot;: { # Metadata from Dialogflow relating to the current transcript segment. # CCAI metadata relating to the current transcript segment.
+          &quot;smartReplyAllowlistCovered&quot;: True or False, # Whether the transcript segment was covered under the configured smart reply allowlist in Agent Assist.
+        },
         &quot;languageCode&quot;: &quot;A String&quot;, # The language code of this segment as a [BCP-47](https://www.rfc-editor.org/rfc/bcp/bcp47.txt) language tag. Example: &quot;en-US&quot;.
+        &quot;messageTime&quot;: &quot;A String&quot;, # The time that the message occurred, if provided.
         &quot;segmentParticipant&quot;: { # The call participant speaking for a given utterance. # The participant of this segment.
           &quot;dialogflowParticipant&quot;: &quot;A String&quot;, # Deprecated. Use `dialogflow_participant_name` instead. The name of the Dialogflow participant. Format: projects/{project}/locations/{location}/conversations/{conversation}/participants/{participant}
           &quot;dialogflowParticipantName&quot;: &quot;A String&quot;, # The name of the participant provided by Dialogflow. Format: projects/{project}/locations/{location}/conversations/{conversation}/participants/{participant}
@@ -354,6 +358,10 @@
           &quot;role&quot;: &quot;A String&quot;, # The role of the participant.
           &quot;userId&quot;: &quot;A String&quot;, # A user-specified ID representing the participant.
         },
+        &quot;sentiment&quot;: { # The data for a sentiment annotation. # The sentiment for this transcript segment.
+          &quot;magnitude&quot;: 3.14, # A non-negative number from 0 to infinity which represents the abolute magnitude of sentiment regardless of score.
+          &quot;score&quot;: 3.14, # The sentiment score between -1.0 (negative) and 1.0 (positive).
+        },
         &quot;text&quot;: &quot;A String&quot;, # The text of this segment.
         &quot;words&quot;: [ # A list of the word-specific information for each word in the segment.
           { # Word-level info for words in a transcript.
@@ -568,7 +576,11 @@
       { # A segment of a full transcript.
         &quot;channelTag&quot;: 42, # For conversations derived from multi-channel audio, this is the channel number corresponding to the audio from that channel. For audioChannelCount = N, its output values can range from &#x27;1&#x27; to &#x27;N&#x27;. A channel tag of 0 indicates that the audio is mono.
         &quot;confidence&quot;: 3.14, # A confidence estimate between 0.0 and 1.0 of the fidelity of this segment. A default value of 0.0 indicates that the value is unset.
+        &quot;dialogflowSegmentMetadata&quot;: { # Metadata from Dialogflow relating to the current transcript segment. # CCAI metadata relating to the current transcript segment.
+          &quot;smartReplyAllowlistCovered&quot;: True or False, # Whether the transcript segment was covered under the configured smart reply allowlist in Agent Assist.
+        },
         &quot;languageCode&quot;: &quot;A String&quot;, # The language code of this segment as a [BCP-47](https://www.rfc-editor.org/rfc/bcp/bcp47.txt) language tag. Example: &quot;en-US&quot;.
+        &quot;messageTime&quot;: &quot;A String&quot;, # The time that the message occurred, if provided.
         &quot;segmentParticipant&quot;: { # The call participant speaking for a given utterance. # The participant of this segment.
           &quot;dialogflowParticipant&quot;: &quot;A String&quot;, # Deprecated. Use `dialogflow_participant_name` instead. The name of the Dialogflow participant. Format: projects/{project}/locations/{location}/conversations/{conversation}/participants/{participant}
           &quot;dialogflowParticipantName&quot;: &quot;A String&quot;, # The name of the participant provided by Dialogflow. Format: projects/{project}/locations/{location}/conversations/{conversation}/participants/{participant}
@@ -576,6 +588,10 @@
           &quot;role&quot;: &quot;A String&quot;, # The role of the participant.
           &quot;userId&quot;: &quot;A String&quot;, # A user-specified ID representing the participant.
         },
+        &quot;sentiment&quot;: { # The data for a sentiment annotation. # The sentiment for this transcript segment.
+          &quot;magnitude&quot;: 3.14, # A non-negative number from 0 to infinity which represents the abolute magnitude of sentiment regardless of score.
+          &quot;score&quot;: 3.14, # The sentiment score between -1.0 (negative) and 1.0 (positive).
+        },
         &quot;text&quot;: &quot;A String&quot;, # The text of this segment.
         &quot;words&quot;: [ # A list of the word-specific information for each word in the segment.
           { # Word-level info for words in a transcript.
@@ -820,7 +836,11 @@
       { # A segment of a full transcript.
         &quot;channelTag&quot;: 42, # For conversations derived from multi-channel audio, this is the channel number corresponding to the audio from that channel. For audioChannelCount = N, its output values can range from &#x27;1&#x27; to &#x27;N&#x27;. A channel tag of 0 indicates that the audio is mono.
         &quot;confidence&quot;: 3.14, # A confidence estimate between 0.0 and 1.0 of the fidelity of this segment. A default value of 0.0 indicates that the value is unset.
+        &quot;dialogflowSegmentMetadata&quot;: { # Metadata from Dialogflow relating to the current transcript segment. # CCAI metadata relating to the current transcript segment.
+          &quot;smartReplyAllowlistCovered&quot;: True or False, # Whether the transcript segment was covered under the configured smart reply allowlist in Agent Assist.
+        },
         &quot;languageCode&quot;: &quot;A String&quot;, # The language code of this segment as a [BCP-47](https://www.rfc-editor.org/rfc/bcp/bcp47.txt) language tag. Example: &quot;en-US&quot;.
+        &quot;messageTime&quot;: &quot;A String&quot;, # The time that the message occurred, if provided.
         &quot;segmentParticipant&quot;: { # The call participant speaking for a given utterance. # The participant of this segment.
           &quot;dialogflowParticipant&quot;: &quot;A String&quot;, # Deprecated. Use `dialogflow_participant_name` instead. The name of the Dialogflow participant. Format: projects/{project}/locations/{location}/conversations/{conversation}/participants/{participant}
           &quot;dialogflowParticipantName&quot;: &quot;A String&quot;, # The name of the participant provided by Dialogflow. Format: projects/{project}/locations/{location}/conversations/{conversation}/participants/{participant}
@@ -828,6 +848,10 @@
           &quot;role&quot;: &quot;A String&quot;, # The role of the participant.
           &quot;userId&quot;: &quot;A String&quot;, # A user-specified ID representing the participant.
         },
+        &quot;sentiment&quot;: { # The data for a sentiment annotation. # The sentiment for this transcript segment.
+          &quot;magnitude&quot;: 3.14, # A non-negative number from 0 to infinity which represents the abolute magnitude of sentiment regardless of score.
+          &quot;score&quot;: 3.14, # The sentiment score between -1.0 (negative) and 1.0 (positive).
+        },
         &quot;text&quot;: &quot;A String&quot;, # The text of this segment.
         &quot;words&quot;: [ # A list of the word-specific information for each word in the segment.
           { # Word-level info for words in a transcript.
@@ -1058,7 +1082,11 @@
           { # A segment of a full transcript.
             &quot;channelTag&quot;: 42, # For conversations derived from multi-channel audio, this is the channel number corresponding to the audio from that channel. For audioChannelCount = N, its output values can range from &#x27;1&#x27; to &#x27;N&#x27;. A channel tag of 0 indicates that the audio is mono.
             &quot;confidence&quot;: 3.14, # A confidence estimate between 0.0 and 1.0 of the fidelity of this segment. A default value of 0.0 indicates that the value is unset.
+            &quot;dialogflowSegmentMetadata&quot;: { # Metadata from Dialogflow relating to the current transcript segment. # CCAI metadata relating to the current transcript segment.
+              &quot;smartReplyAllowlistCovered&quot;: True or False, # Whether the transcript segment was covered under the configured smart reply allowlist in Agent Assist.
+            },
             &quot;languageCode&quot;: &quot;A String&quot;, # The language code of this segment as a [BCP-47](https://www.rfc-editor.org/rfc/bcp/bcp47.txt) language tag. Example: &quot;en-US&quot;.
+            &quot;messageTime&quot;: &quot;A String&quot;, # The time that the message occurred, if provided.
             &quot;segmentParticipant&quot;: { # The call participant speaking for a given utterance. # The participant of this segment.
               &quot;dialogflowParticipant&quot;: &quot;A String&quot;, # Deprecated. Use `dialogflow_participant_name` instead. The name of the Dialogflow participant. Format: projects/{project}/locations/{location}/conversations/{conversation}/participants/{participant}
               &quot;dialogflowParticipantName&quot;: &quot;A String&quot;, # The name of the participant provided by Dialogflow. Format: projects/{project}/locations/{location}/conversations/{conversation}/participants/{participant}
@@ -1066,6 +1094,10 @@
               &quot;role&quot;: &quot;A String&quot;, # The role of the participant.
               &quot;userId&quot;: &quot;A String&quot;, # A user-specified ID representing the participant.
             },
+            &quot;sentiment&quot;: { # The data for a sentiment annotation. # The sentiment for this transcript segment.
+              &quot;magnitude&quot;: 3.14, # A non-negative number from 0 to infinity which represents the abolute magnitude of sentiment regardless of score.
+              &quot;score&quot;: 3.14, # The sentiment score between -1.0 (negative) and 1.0 (positive).
+            },
             &quot;text&quot;: &quot;A String&quot;, # The text of this segment.
             &quot;words&quot;: [ # A list of the word-specific information for each word in the segment.
               { # Word-level info for words in a transcript.
@@ -1298,7 +1330,11 @@
       { # A segment of a full transcript.
         &quot;channelTag&quot;: 42, # For conversations derived from multi-channel audio, this is the channel number corresponding to the audio from that channel. For audioChannelCount = N, its output values can range from &#x27;1&#x27; to &#x27;N&#x27;. A channel tag of 0 indicates that the audio is mono.
         &quot;confidence&quot;: 3.14, # A confidence estimate between 0.0 and 1.0 of the fidelity of this segment. A default value of 0.0 indicates that the value is unset.
+        &quot;dialogflowSegmentMetadata&quot;: { # Metadata from Dialogflow relating to the current transcript segment. # CCAI metadata relating to the current transcript segment.
+          &quot;smartReplyAllowlistCovered&quot;: True or False, # Whether the transcript segment was covered under the configured smart reply allowlist in Agent Assist.
+        },
         &quot;languageCode&quot;: &quot;A String&quot;, # The language code of this segment as a [BCP-47](https://www.rfc-editor.org/rfc/bcp/bcp47.txt) language tag. Example: &quot;en-US&quot;.
+        &quot;messageTime&quot;: &quot;A String&quot;, # The time that the message occurred, if provided.
         &quot;segmentParticipant&quot;: { # The call participant speaking for a given utterance. # The participant of this segment.
           &quot;dialogflowParticipant&quot;: &quot;A String&quot;, # Deprecated. Use `dialogflow_participant_name` instead. The name of the Dialogflow participant. Format: projects/{project}/locations/{location}/conversations/{conversation}/participants/{participant}
           &quot;dialogflowParticipantName&quot;: &quot;A String&quot;, # The name of the participant provided by Dialogflow. Format: projects/{project}/locations/{location}/conversations/{conversation}/participants/{participant}
@@ -1306,6 +1342,10 @@
           &quot;role&quot;: &quot;A String&quot;, # The role of the participant.
           &quot;userId&quot;: &quot;A String&quot;, # A user-specified ID representing the participant.
         },
+        &quot;sentiment&quot;: { # The data for a sentiment annotation. # The sentiment for this transcript segment.
+          &quot;magnitude&quot;: 3.14, # A non-negative number from 0 to infinity which represents the abolute magnitude of sentiment regardless of score.
+          &quot;score&quot;: 3.14, # The sentiment score between -1.0 (negative) and 1.0 (positive).
+        },
         &quot;text&quot;: &quot;A String&quot;, # The text of this segment.
         &quot;words&quot;: [ # A list of the word-specific information for each word in the segment.
           { # Word-level info for words in a transcript.
@@ -1520,7 +1560,11 @@
       { # A segment of a full transcript.
         &quot;channelTag&quot;: 42, # For conversations derived from multi-channel audio, this is the channel number corresponding to the audio from that channel. For audioChannelCount = N, its output values can range from &#x27;1&#x27; to &#x27;N&#x27;. A channel tag of 0 indicates that the audio is mono.
         &quot;confidence&quot;: 3.14, # A confidence estimate between 0.0 and 1.0 of the fidelity of this segment. A default value of 0.0 indicates that the value is unset.
+        &quot;dialogflowSegmentMetadata&quot;: { # Metadata from Dialogflow relating to the current transcript segment. # CCAI metadata relating to the current transcript segment.
+          &quot;smartReplyAllowlistCovered&quot;: True or False, # Whether the transcript segment was covered under the configured smart reply allowlist in Agent Assist.
+        },
         &quot;languageCode&quot;: &quot;A String&quot;, # The language code of this segment as a [BCP-47](https://www.rfc-editor.org/rfc/bcp/bcp47.txt) language tag. Example: &quot;en-US&quot;.
+        &quot;messageTime&quot;: &quot;A String&quot;, # The time that the message occurred, if provided.
         &quot;segmentParticipant&quot;: { # The call participant speaking for a given utterance. # The participant of this segment.
           &quot;dialogflowParticipant&quot;: &quot;A String&quot;, # Deprecated. Use `dialogflow_participant_name` instead. The name of the Dialogflow participant. Format: projects/{project}/locations/{location}/conversations/{conversation}/participants/{participant}
           &quot;dialogflowParticipantName&quot;: &quot;A String&quot;, # The name of the participant provided by Dialogflow. Format: projects/{project}/locations/{location}/conversations/{conversation}/participants/{participant}
@@ -1528,6 +1572,10 @@
           &quot;role&quot;: &quot;A String&quot;, # The role of the participant.
           &quot;userId&quot;: &quot;A String&quot;, # A user-specified ID representing the participant.
         },
+        &quot;sentiment&quot;: { # The data for a sentiment annotation. # The sentiment for this transcript segment.
+          &quot;magnitude&quot;: 3.14, # A non-negative number from 0 to infinity which represents the abolute magnitude of sentiment regardless of score.
+          &quot;score&quot;: 3.14, # The sentiment score between -1.0 (negative) and 1.0 (positive).
+        },
         &quot;text&quot;: &quot;A String&quot;, # The text of this segment.
         &quot;words&quot;: [ # A list of the word-specific information for each word in the segment.
           { # Word-level info for words in a transcript.
diff --git a/docs/dyn/datacatalog_v1.projects.locations.entryGroups.entries.html b/docs/dyn/datacatalog_v1.projects.locations.entryGroups.entries.html
index ff70feb..7a0b06f 100644
--- a/docs/dyn/datacatalog_v1.projects.locations.entryGroups.entries.html
+++ b/docs/dyn/datacatalog_v1.projects.locations.entryGroups.entries.html
@@ -96,7 +96,7 @@
 <p class="firstline">Gets the access control policy for a resource. May return: * A`NOT_FOUND` error if the resource doesn't exist or you don't have the permission to view it. * An empty policy if the resource exists but doesn't have a set policy. Supported resources are: - Tag templates - Entry groups Note: This method doesn't get policies from Google Cloud Platform resources ingested into Data Catalog. To call this method, you must have the following Google IAM permissions: - `datacatalog.tagTemplates.getIamPolicy` to get policies on tag templates. - `datacatalog.entryGroups.getIamPolicy` to get policies on entry groups.</p>
 <p class="toc_element">
   <code><a href="#list">list(parent, pageSize=None, pageToken=None, readMask=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Lists entries.</p>
+<p class="firstline">Lists entries. Note: Currently, this method can list only custom entries. To get a list of both custom and automatically created entries, use SearchCatalog.</p>
 <p class="toc_element">
   <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
 <p class="firstline">Retrieves the next page of results.</p>
@@ -539,7 +539,7 @@
 
 <div class="method">
     <code class="details" id="list">list(parent, pageSize=None, pageToken=None, readMask=None, x__xgafv=None)</code>
-  <pre>Lists entries.
+  <pre>Lists entries. Note: Currently, this method can list only custom entries. To get a list of both custom and automatically created entries, use SearchCatalog.
 
 Args:
   parent: string, Required. The name of the entry group that contains the entries to list. Can be provided in URL format. (required)
diff --git a/docs/dyn/datastore_v1.projects.html b/docs/dyn/datastore_v1.projects.html
index 4f71a3f..96acf9c 100644
--- a/docs/dyn/datastore_v1.projects.html
+++ b/docs/dyn/datastore_v1.projects.html
@@ -248,7 +248,40 @@
           ],
         },
         &quot;properties&quot;: { # The entity&#x27;s properties. The map&#x27;s keys are property names. A property name matching regex `__.*__` is reserved. A reserved property name is forbidden in certain documented contexts. The name must not contain more than 500 characters. The name cannot be `&quot;&quot;`.
-          &quot;a_key&quot;: # Object with schema name: Value
+          &quot;a_key&quot;: { # A message that can hold any of the supported value types and associated metadata.
+            &quot;arrayValue&quot;: { # An array value. # An array value. Cannot contain another array value. A `Value` instance that sets field `array_value` must not set fields `meaning` or `exclude_from_indexes`.
+              &quot;values&quot;: [ # Values in the array. The order of values in an array is preserved as long as all values have identical settings for &#x27;exclude_from_indexes&#x27;.
+                # Object with schema name: Value
+              ],
+            },
+            &quot;blobValue&quot;: &quot;A String&quot;, # A blob value. May have at most 1,000,000 bytes. When `exclude_from_indexes` is false, may have at most 1500 bytes. In JSON requests, must be base64-encoded.
+            &quot;booleanValue&quot;: True or False, # A boolean value.
+            &quot;doubleValue&quot;: 3.14, # A double value.
+            &quot;entityValue&quot;: # Object with schema name: Entity # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
+            &quot;excludeFromIndexes&quot;: True or False, # If the value should be excluded from all indexes including those defined explicitly.
+            &quot;geoPointValue&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
+              &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
+              &quot;longitude&quot;: 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
+            },
+            &quot;integerValue&quot;: &quot;A String&quot;, # An integer value.
+            &quot;keyValue&quot;: { # A unique identifier for an entity. If a key&#x27;s partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # A key value.
+              &quot;partitionId&quot;: { # A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. Partition dimensions: - May be `&quot;&quot;`. - Must be valid UTF-8 bytes. - Must have values that match regex `[A-Za-z\d\.\-_]{1,100}` If the value of any dimension matches regex `__.*__`, the partition is reserved/read-only. A reserved/read-only partition ID is forbidden in certain documented contexts. Foreign partition IDs (in which the project ID does not match the context project ID ) are discouraged. Reads and writes of foreign partition IDs may fail if the project is not in an active state. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.
+                &quot;namespaceId&quot;: &quot;A String&quot;, # If not empty, the ID of the namespace to which the entities belong.
+                &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project to which the entities belong.
+              },
+              &quot;path&quot;: [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element&#x27;s _ancestors_. An entity path is always fully complete: *all* of the entity&#x27;s ancestors are required to be in the path along with the entity identifier itself. The only exception is that in some documented cases, the identifier in the last path element (for the entity) itself may be omitted. For example, the last path element of the key of `Mutation.insert` may have no identifier. A path can never be empty, and a path can have at most 100 elements.
+                { # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.
+                  &quot;id&quot;: &quot;A String&quot;, # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.
+                  &quot;kind&quot;: &quot;A String&quot;, # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `&quot;&quot;`.
+                  &quot;name&quot;: &quot;A String&quot;, # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `&quot;&quot;`.
+                },
+              ],
+            },
+            &quot;meaning&quot;: 42, # The `meaning` field should only be populated for backwards compatibility.
+            &quot;nullValue&quot;: &quot;A String&quot;, # A null value.
+            &quot;stringValue&quot;: &quot;A String&quot;, # A UTF-8 encoded string value. When `exclude_from_indexes` is false (it is indexed) , may have at most 1500 bytes. Otherwise, may be set to at most 1,000,000 bytes.
+            &quot;timestampValue&quot;: &quot;A String&quot;, # A timestamp value. When stored in the Datastore, precise only to microseconds; any additional precision is rounded down.
+          },
         },
       },
       &quot;update&quot;: { # A Datastore data object. An entity is limited to 1 megabyte when stored. That _roughly_ corresponds to a limit of 1 megabyte for the serialized form of this message. # The entity to update. The entity must already exist. Must have a complete key path.
@@ -266,7 +299,40 @@
           ],
         },
         &quot;properties&quot;: { # The entity&#x27;s properties. The map&#x27;s keys are property names. A property name matching regex `__.*__` is reserved. A reserved property name is forbidden in certain documented contexts. The name must not contain more than 500 characters. The name cannot be `&quot;&quot;`.
-          &quot;a_key&quot;: # Object with schema name: Value
+          &quot;a_key&quot;: { # A message that can hold any of the supported value types and associated metadata.
+            &quot;arrayValue&quot;: { # An array value. # An array value. Cannot contain another array value. A `Value` instance that sets field `array_value` must not set fields `meaning` or `exclude_from_indexes`.
+              &quot;values&quot;: [ # Values in the array. The order of values in an array is preserved as long as all values have identical settings for &#x27;exclude_from_indexes&#x27;.
+                # Object with schema name: Value
+              ],
+            },
+            &quot;blobValue&quot;: &quot;A String&quot;, # A blob value. May have at most 1,000,000 bytes. When `exclude_from_indexes` is false, may have at most 1500 bytes. In JSON requests, must be base64-encoded.
+            &quot;booleanValue&quot;: True or False, # A boolean value.
+            &quot;doubleValue&quot;: 3.14, # A double value.
+            &quot;entityValue&quot;: # Object with schema name: Entity # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
+            &quot;excludeFromIndexes&quot;: True or False, # If the value should be excluded from all indexes including those defined explicitly.
+            &quot;geoPointValue&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
+              &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
+              &quot;longitude&quot;: 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
+            },
+            &quot;integerValue&quot;: &quot;A String&quot;, # An integer value.
+            &quot;keyValue&quot;: { # A unique identifier for an entity. If a key&#x27;s partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # A key value.
+              &quot;partitionId&quot;: { # A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. Partition dimensions: - May be `&quot;&quot;`. - Must be valid UTF-8 bytes. - Must have values that match regex `[A-Za-z\d\.\-_]{1,100}` If the value of any dimension matches regex `__.*__`, the partition is reserved/read-only. A reserved/read-only partition ID is forbidden in certain documented contexts. Foreign partition IDs (in which the project ID does not match the context project ID ) are discouraged. Reads and writes of foreign partition IDs may fail if the project is not in an active state. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.
+                &quot;namespaceId&quot;: &quot;A String&quot;, # If not empty, the ID of the namespace to which the entities belong.
+                &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project to which the entities belong.
+              },
+              &quot;path&quot;: [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element&#x27;s _ancestors_. An entity path is always fully complete: *all* of the entity&#x27;s ancestors are required to be in the path along with the entity identifier itself. The only exception is that in some documented cases, the identifier in the last path element (for the entity) itself may be omitted. For example, the last path element of the key of `Mutation.insert` may have no identifier. A path can never be empty, and a path can have at most 100 elements.
+                { # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.
+                  &quot;id&quot;: &quot;A String&quot;, # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.
+                  &quot;kind&quot;: &quot;A String&quot;, # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `&quot;&quot;`.
+                  &quot;name&quot;: &quot;A String&quot;, # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `&quot;&quot;`.
+                },
+              ],
+            },
+            &quot;meaning&quot;: 42, # The `meaning` field should only be populated for backwards compatibility.
+            &quot;nullValue&quot;: &quot;A String&quot;, # A null value.
+            &quot;stringValue&quot;: &quot;A String&quot;, # A UTF-8 encoded string value. When `exclude_from_indexes` is false (it is indexed) , may have at most 1500 bytes. Otherwise, may be set to at most 1,000,000 bytes.
+            &quot;timestampValue&quot;: &quot;A String&quot;, # A timestamp value. When stored in the Datastore, precise only to microseconds; any additional precision is rounded down.
+          },
         },
       },
       &quot;upsert&quot;: { # A Datastore data object. An entity is limited to 1 megabyte when stored. That _roughly_ corresponds to a limit of 1 megabyte for the serialized form of this message. # The entity to upsert. The entity may or may not already exist. The entity key&#x27;s final path element may be incomplete.
@@ -284,7 +350,40 @@
           ],
         },
         &quot;properties&quot;: { # The entity&#x27;s properties. The map&#x27;s keys are property names. A property name matching regex `__.*__` is reserved. A reserved property name is forbidden in certain documented contexts. The name must not contain more than 500 characters. The name cannot be `&quot;&quot;`.
-          &quot;a_key&quot;: # Object with schema name: Value
+          &quot;a_key&quot;: { # A message that can hold any of the supported value types and associated metadata.
+            &quot;arrayValue&quot;: { # An array value. # An array value. Cannot contain another array value. A `Value` instance that sets field `array_value` must not set fields `meaning` or `exclude_from_indexes`.
+              &quot;values&quot;: [ # Values in the array. The order of values in an array is preserved as long as all values have identical settings for &#x27;exclude_from_indexes&#x27;.
+                # Object with schema name: Value
+              ],
+            },
+            &quot;blobValue&quot;: &quot;A String&quot;, # A blob value. May have at most 1,000,000 bytes. When `exclude_from_indexes` is false, may have at most 1500 bytes. In JSON requests, must be base64-encoded.
+            &quot;booleanValue&quot;: True or False, # A boolean value.
+            &quot;doubleValue&quot;: 3.14, # A double value.
+            &quot;entityValue&quot;: # Object with schema name: Entity # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
+            &quot;excludeFromIndexes&quot;: True or False, # If the value should be excluded from all indexes including those defined explicitly.
+            &quot;geoPointValue&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
+              &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
+              &quot;longitude&quot;: 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
+            },
+            &quot;integerValue&quot;: &quot;A String&quot;, # An integer value.
+            &quot;keyValue&quot;: { # A unique identifier for an entity. If a key&#x27;s partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # A key value.
+              &quot;partitionId&quot;: { # A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. Partition dimensions: - May be `&quot;&quot;`. - Must be valid UTF-8 bytes. - Must have values that match regex `[A-Za-z\d\.\-_]{1,100}` If the value of any dimension matches regex `__.*__`, the partition is reserved/read-only. A reserved/read-only partition ID is forbidden in certain documented contexts. Foreign partition IDs (in which the project ID does not match the context project ID ) are discouraged. Reads and writes of foreign partition IDs may fail if the project is not in an active state. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.
+                &quot;namespaceId&quot;: &quot;A String&quot;, # If not empty, the ID of the namespace to which the entities belong.
+                &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project to which the entities belong.
+              },
+              &quot;path&quot;: [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element&#x27;s _ancestors_. An entity path is always fully complete: *all* of the entity&#x27;s ancestors are required to be in the path along with the entity identifier itself. The only exception is that in some documented cases, the identifier in the last path element (for the entity) itself may be omitted. For example, the last path element of the key of `Mutation.insert` may have no identifier. A path can never be empty, and a path can have at most 100 elements.
+                { # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.
+                  &quot;id&quot;: &quot;A String&quot;, # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.
+                  &quot;kind&quot;: &quot;A String&quot;, # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `&quot;&quot;`.
+                  &quot;name&quot;: &quot;A String&quot;, # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `&quot;&quot;`.
+                },
+              ],
+            },
+            &quot;meaning&quot;: 42, # The `meaning` field should only be populated for backwards compatibility.
+            &quot;nullValue&quot;: &quot;A String&quot;, # A null value.
+            &quot;stringValue&quot;: &quot;A String&quot;, # A UTF-8 encoded string value. When `exclude_from_indexes` is false (it is indexed) , may have at most 1500 bytes. Otherwise, may be set to at most 1,000,000 bytes.
+            &quot;timestampValue&quot;: &quot;A String&quot;, # A timestamp value. When stored in the Datastore, precise only to microseconds; any additional precision is rounded down.
+          },
         },
       },
     },
@@ -503,7 +602,40 @@
           ],
         },
         &quot;properties&quot;: { # The entity&#x27;s properties. The map&#x27;s keys are property names. A property name matching regex `__.*__` is reserved. A reserved property name is forbidden in certain documented contexts. The name must not contain more than 500 characters. The name cannot be `&quot;&quot;`.
-          &quot;a_key&quot;: # Object with schema name: Value
+          &quot;a_key&quot;: { # A message that can hold any of the supported value types and associated metadata.
+            &quot;arrayValue&quot;: { # An array value. # An array value. Cannot contain another array value. A `Value` instance that sets field `array_value` must not set fields `meaning` or `exclude_from_indexes`.
+              &quot;values&quot;: [ # Values in the array. The order of values in an array is preserved as long as all values have identical settings for &#x27;exclude_from_indexes&#x27;.
+                # Object with schema name: Value
+              ],
+            },
+            &quot;blobValue&quot;: &quot;A String&quot;, # A blob value. May have at most 1,000,000 bytes. When `exclude_from_indexes` is false, may have at most 1500 bytes. In JSON requests, must be base64-encoded.
+            &quot;booleanValue&quot;: True or False, # A boolean value.
+            &quot;doubleValue&quot;: 3.14, # A double value.
+            &quot;entityValue&quot;: # Object with schema name: Entity # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
+            &quot;excludeFromIndexes&quot;: True or False, # If the value should be excluded from all indexes including those defined explicitly.
+            &quot;geoPointValue&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
+              &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
+              &quot;longitude&quot;: 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
+            },
+            &quot;integerValue&quot;: &quot;A String&quot;, # An integer value.
+            &quot;keyValue&quot;: { # A unique identifier for an entity. If a key&#x27;s partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # A key value.
+              &quot;partitionId&quot;: { # A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. Partition dimensions: - May be `&quot;&quot;`. - Must be valid UTF-8 bytes. - Must have values that match regex `[A-Za-z\d\.\-_]{1,100}` If the value of any dimension matches regex `__.*__`, the partition is reserved/read-only. A reserved/read-only partition ID is forbidden in certain documented contexts. Foreign partition IDs (in which the project ID does not match the context project ID ) are discouraged. Reads and writes of foreign partition IDs may fail if the project is not in an active state. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.
+                &quot;namespaceId&quot;: &quot;A String&quot;, # If not empty, the ID of the namespace to which the entities belong.
+                &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project to which the entities belong.
+              },
+              &quot;path&quot;: [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element&#x27;s _ancestors_. An entity path is always fully complete: *all* of the entity&#x27;s ancestors are required to be in the path along with the entity identifier itself. The only exception is that in some documented cases, the identifier in the last path element (for the entity) itself may be omitted. For example, the last path element of the key of `Mutation.insert` may have no identifier. A path can never be empty, and a path can have at most 100 elements.
+                { # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.
+                  &quot;id&quot;: &quot;A String&quot;, # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.
+                  &quot;kind&quot;: &quot;A String&quot;, # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `&quot;&quot;`.
+                  &quot;name&quot;: &quot;A String&quot;, # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `&quot;&quot;`.
+                },
+              ],
+            },
+            &quot;meaning&quot;: 42, # The `meaning` field should only be populated for backwards compatibility.
+            &quot;nullValue&quot;: &quot;A String&quot;, # A null value.
+            &quot;stringValue&quot;: &quot;A String&quot;, # A UTF-8 encoded string value. When `exclude_from_indexes` is false (it is indexed) , may have at most 1500 bytes. Otherwise, may be set to at most 1,000,000 bytes.
+            &quot;timestampValue&quot;: &quot;A String&quot;, # A timestamp value. When stored in the Datastore, precise only to microseconds; any additional precision is rounded down.
+          },
         },
       },
       &quot;version&quot;: &quot;A String&quot;, # The version of the entity, a strictly positive number that monotonically increases with changes to the entity. This field is set for `FULL` entity results. For missing entities in `LookupResponse`, this is the version of the snapshot that was used to look up the entity, and it is always set except for eventually consistent reads.
@@ -527,7 +659,40 @@
           ],
         },
         &quot;properties&quot;: { # The entity&#x27;s properties. The map&#x27;s keys are property names. A property name matching regex `__.*__` is reserved. A reserved property name is forbidden in certain documented contexts. The name must not contain more than 500 characters. The name cannot be `&quot;&quot;`.
-          &quot;a_key&quot;: # Object with schema name: Value
+          &quot;a_key&quot;: { # A message that can hold any of the supported value types and associated metadata.
+            &quot;arrayValue&quot;: { # An array value. # An array value. Cannot contain another array value. A `Value` instance that sets field `array_value` must not set fields `meaning` or `exclude_from_indexes`.
+              &quot;values&quot;: [ # Values in the array. The order of values in an array is preserved as long as all values have identical settings for &#x27;exclude_from_indexes&#x27;.
+                # Object with schema name: Value
+              ],
+            },
+            &quot;blobValue&quot;: &quot;A String&quot;, # A blob value. May have at most 1,000,000 bytes. When `exclude_from_indexes` is false, may have at most 1500 bytes. In JSON requests, must be base64-encoded.
+            &quot;booleanValue&quot;: True or False, # A boolean value.
+            &quot;doubleValue&quot;: 3.14, # A double value.
+            &quot;entityValue&quot;: # Object with schema name: Entity # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
+            &quot;excludeFromIndexes&quot;: True or False, # If the value should be excluded from all indexes including those defined explicitly.
+            &quot;geoPointValue&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
+              &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
+              &quot;longitude&quot;: 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
+            },
+            &quot;integerValue&quot;: &quot;A String&quot;, # An integer value.
+            &quot;keyValue&quot;: { # A unique identifier for an entity. If a key&#x27;s partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # A key value.
+              &quot;partitionId&quot;: { # A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. Partition dimensions: - May be `&quot;&quot;`. - Must be valid UTF-8 bytes. - Must have values that match regex `[A-Za-z\d\.\-_]{1,100}` If the value of any dimension matches regex `__.*__`, the partition is reserved/read-only. A reserved/read-only partition ID is forbidden in certain documented contexts. Foreign partition IDs (in which the project ID does not match the context project ID ) are discouraged. Reads and writes of foreign partition IDs may fail if the project is not in an active state. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.
+                &quot;namespaceId&quot;: &quot;A String&quot;, # If not empty, the ID of the namespace to which the entities belong.
+                &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project to which the entities belong.
+              },
+              &quot;path&quot;: [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element&#x27;s _ancestors_. An entity path is always fully complete: *all* of the entity&#x27;s ancestors are required to be in the path along with the entity identifier itself. The only exception is that in some documented cases, the identifier in the last path element (for the entity) itself may be omitted. For example, the last path element of the key of `Mutation.insert` may have no identifier. A path can never be empty, and a path can have at most 100 elements.
+                { # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.
+                  &quot;id&quot;: &quot;A String&quot;, # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.
+                  &quot;kind&quot;: &quot;A String&quot;, # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `&quot;&quot;`.
+                  &quot;name&quot;: &quot;A String&quot;, # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `&quot;&quot;`.
+                },
+              ],
+            },
+            &quot;meaning&quot;: 42, # The `meaning` field should only be populated for backwards compatibility.
+            &quot;nullValue&quot;: &quot;A String&quot;, # A null value.
+            &quot;stringValue&quot;: &quot;A String&quot;, # A UTF-8 encoded string value. When `exclude_from_indexes` is false (it is indexed) , may have at most 1500 bytes. Otherwise, may be set to at most 1,000,000 bytes.
+            &quot;timestampValue&quot;: &quot;A String&quot;, # A timestamp value. When stored in the Datastore, precise only to microseconds; any additional precision is rounded down.
+          },
         },
       },
       &quot;version&quot;: &quot;A String&quot;, # The version of the entity, a strictly positive number that monotonically increases with changes to the entity. This field is set for `FULL` entity results. For missing entities in `LookupResponse`, this is the version of the snapshot that was used to look up the entity, and it is always set except for eventually consistent reads.
@@ -625,24 +790,7 @@
           &quot;blobValue&quot;: &quot;A String&quot;, # A blob value. May have at most 1,000,000 bytes. When `exclude_from_indexes` is false, may have at most 1500 bytes. In JSON requests, must be base64-encoded.
           &quot;booleanValue&quot;: True or False, # A boolean value.
           &quot;doubleValue&quot;: 3.14, # A double value.
-          &quot;entityValue&quot;: { # A Datastore data object. An entity is limited to 1 megabyte when stored. That _roughly_ corresponds to a limit of 1 megabyte for the serialized form of this message. # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
-            &quot;key&quot;: { # A unique identifier for an entity. If a key&#x27;s partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # The entity&#x27;s key. An entity must have a key, unless otherwise documented (for example, an entity in `Value.entity_value` may have no key). An entity&#x27;s kind is its key path&#x27;s last element&#x27;s kind, or null if it has no key.
-              &quot;partitionId&quot;: { # A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. Partition dimensions: - May be `&quot;&quot;`. - Must be valid UTF-8 bytes. - Must have values that match regex `[A-Za-z\d\.\-_]{1,100}` If the value of any dimension matches regex `__.*__`, the partition is reserved/read-only. A reserved/read-only partition ID is forbidden in certain documented contexts. Foreign partition IDs (in which the project ID does not match the context project ID ) are discouraged. Reads and writes of foreign partition IDs may fail if the project is not in an active state. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.
-                &quot;namespaceId&quot;: &quot;A String&quot;, # If not empty, the ID of the namespace to which the entities belong.
-                &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project to which the entities belong.
-              },
-              &quot;path&quot;: [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element&#x27;s _ancestors_. An entity path is always fully complete: *all* of the entity&#x27;s ancestors are required to be in the path along with the entity identifier itself. The only exception is that in some documented cases, the identifier in the last path element (for the entity) itself may be omitted. For example, the last path element of the key of `Mutation.insert` may have no identifier. A path can never be empty, and a path can have at most 100 elements.
-                { # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.
-                  &quot;id&quot;: &quot;A String&quot;, # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.
-                  &quot;kind&quot;: &quot;A String&quot;, # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `&quot;&quot;`.
-                  &quot;name&quot;: &quot;A String&quot;, # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `&quot;&quot;`.
-                },
-              ],
-            },
-            &quot;properties&quot;: { # The entity&#x27;s properties. The map&#x27;s keys are property names. A property name matching regex `__.*__` is reserved. A reserved property name is forbidden in certain documented contexts. The name must not contain more than 500 characters. The name cannot be `&quot;&quot;`.
-              &quot;a_key&quot;: # Object with schema name: Value
-            },
-          },
+          &quot;entityValue&quot;: # Object with schema name: Entity # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
           &quot;excludeFromIndexes&quot;: True or False, # If the value should be excluded from all indexes including those defined explicitly.
           &quot;geoPointValue&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
             &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
@@ -681,24 +829,7 @@
           &quot;blobValue&quot;: &quot;A String&quot;, # A blob value. May have at most 1,000,000 bytes. When `exclude_from_indexes` is false, may have at most 1500 bytes. In JSON requests, must be base64-encoded.
           &quot;booleanValue&quot;: True or False, # A boolean value.
           &quot;doubleValue&quot;: 3.14, # A double value.
-          &quot;entityValue&quot;: { # A Datastore data object. An entity is limited to 1 megabyte when stored. That _roughly_ corresponds to a limit of 1 megabyte for the serialized form of this message. # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
-            &quot;key&quot;: { # A unique identifier for an entity. If a key&#x27;s partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # The entity&#x27;s key. An entity must have a key, unless otherwise documented (for example, an entity in `Value.entity_value` may have no key). An entity&#x27;s kind is its key path&#x27;s last element&#x27;s kind, or null if it has no key.
-              &quot;partitionId&quot;: { # A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. Partition dimensions: - May be `&quot;&quot;`. - Must be valid UTF-8 bytes. - Must have values that match regex `[A-Za-z\d\.\-_]{1,100}` If the value of any dimension matches regex `__.*__`, the partition is reserved/read-only. A reserved/read-only partition ID is forbidden in certain documented contexts. Foreign partition IDs (in which the project ID does not match the context project ID ) are discouraged. Reads and writes of foreign partition IDs may fail if the project is not in an active state. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.
-                &quot;namespaceId&quot;: &quot;A String&quot;, # If not empty, the ID of the namespace to which the entities belong.
-                &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project to which the entities belong.
-              },
-              &quot;path&quot;: [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element&#x27;s _ancestors_. An entity path is always fully complete: *all* of the entity&#x27;s ancestors are required to be in the path along with the entity identifier itself. The only exception is that in some documented cases, the identifier in the last path element (for the entity) itself may be omitted. For example, the last path element of the key of `Mutation.insert` may have no identifier. A path can never be empty, and a path can have at most 100 elements.
-                { # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.
-                  &quot;id&quot;: &quot;A String&quot;, # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.
-                  &quot;kind&quot;: &quot;A String&quot;, # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `&quot;&quot;`.
-                  &quot;name&quot;: &quot;A String&quot;, # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `&quot;&quot;`.
-                },
-              ],
-            },
-            &quot;properties&quot;: { # The entity&#x27;s properties. The map&#x27;s keys are property names. A property name matching regex `__.*__` is reserved. A reserved property name is forbidden in certain documented contexts. The name must not contain more than 500 characters. The name cannot be `&quot;&quot;`.
-              &quot;a_key&quot;: # Object with schema name: Value
-            },
-          },
+          &quot;entityValue&quot;: # Object with schema name: Entity # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
           &quot;excludeFromIndexes&quot;: True or False, # If the value should be excluded from all indexes including those defined explicitly.
           &quot;geoPointValue&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
             &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
@@ -759,24 +890,7 @@
           &quot;blobValue&quot;: &quot;A String&quot;, # A blob value. May have at most 1,000,000 bytes. When `exclude_from_indexes` is false, may have at most 1500 bytes. In JSON requests, must be base64-encoded.
           &quot;booleanValue&quot;: True or False, # A boolean value.
           &quot;doubleValue&quot;: 3.14, # A double value.
-          &quot;entityValue&quot;: { # A Datastore data object. An entity is limited to 1 megabyte when stored. That _roughly_ corresponds to a limit of 1 megabyte for the serialized form of this message. # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
-            &quot;key&quot;: { # A unique identifier for an entity. If a key&#x27;s partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # The entity&#x27;s key. An entity must have a key, unless otherwise documented (for example, an entity in `Value.entity_value` may have no key). An entity&#x27;s kind is its key path&#x27;s last element&#x27;s kind, or null if it has no key.
-              &quot;partitionId&quot;: { # A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. Partition dimensions: - May be `&quot;&quot;`. - Must be valid UTF-8 bytes. - Must have values that match regex `[A-Za-z\d\.\-_]{1,100}` If the value of any dimension matches regex `__.*__`, the partition is reserved/read-only. A reserved/read-only partition ID is forbidden in certain documented contexts. Foreign partition IDs (in which the project ID does not match the context project ID ) are discouraged. Reads and writes of foreign partition IDs may fail if the project is not in an active state. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.
-                &quot;namespaceId&quot;: &quot;A String&quot;, # If not empty, the ID of the namespace to which the entities belong.
-                &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project to which the entities belong.
-              },
-              &quot;path&quot;: [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element&#x27;s _ancestors_. An entity path is always fully complete: *all* of the entity&#x27;s ancestors are required to be in the path along with the entity identifier itself. The only exception is that in some documented cases, the identifier in the last path element (for the entity) itself may be omitted. For example, the last path element of the key of `Mutation.insert` may have no identifier. A path can never be empty, and a path can have at most 100 elements.
-                { # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.
-                  &quot;id&quot;: &quot;A String&quot;, # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.
-                  &quot;kind&quot;: &quot;A String&quot;, # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `&quot;&quot;`.
-                  &quot;name&quot;: &quot;A String&quot;, # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `&quot;&quot;`.
-                },
-              ],
-            },
-            &quot;properties&quot;: { # The entity&#x27;s properties. The map&#x27;s keys are property names. A property name matching regex `__.*__` is reserved. A reserved property name is forbidden in certain documented contexts. The name must not contain more than 500 characters. The name cannot be `&quot;&quot;`.
-              &quot;a_key&quot;: # Object with schema name: Value
-            },
-          },
+          &quot;entityValue&quot;: # Object with schema name: Entity # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
           &quot;excludeFromIndexes&quot;: True or False, # If the value should be excluded from all indexes including those defined explicitly.
           &quot;geoPointValue&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
             &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
@@ -863,7 +977,40 @@
             ],
           },
           &quot;properties&quot;: { # The entity&#x27;s properties. The map&#x27;s keys are property names. A property name matching regex `__.*__` is reserved. A reserved property name is forbidden in certain documented contexts. The name must not contain more than 500 characters. The name cannot be `&quot;&quot;`.
-            &quot;a_key&quot;: # Object with schema name: Value
+            &quot;a_key&quot;: { # A message that can hold any of the supported value types and associated metadata.
+              &quot;arrayValue&quot;: { # An array value. # An array value. Cannot contain another array value. A `Value` instance that sets field `array_value` must not set fields `meaning` or `exclude_from_indexes`.
+                &quot;values&quot;: [ # Values in the array. The order of values in an array is preserved as long as all values have identical settings for &#x27;exclude_from_indexes&#x27;.
+                  # Object with schema name: Value
+                ],
+              },
+              &quot;blobValue&quot;: &quot;A String&quot;, # A blob value. May have at most 1,000,000 bytes. When `exclude_from_indexes` is false, may have at most 1500 bytes. In JSON requests, must be base64-encoded.
+              &quot;booleanValue&quot;: True or False, # A boolean value.
+              &quot;doubleValue&quot;: 3.14, # A double value.
+              &quot;entityValue&quot;: # Object with schema name: Entity # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
+              &quot;excludeFromIndexes&quot;: True or False, # If the value should be excluded from all indexes including those defined explicitly.
+              &quot;geoPointValue&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
+                &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
+                &quot;longitude&quot;: 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
+              },
+              &quot;integerValue&quot;: &quot;A String&quot;, # An integer value.
+              &quot;keyValue&quot;: { # A unique identifier for an entity. If a key&#x27;s partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # A key value.
+                &quot;partitionId&quot;: { # A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. Partition dimensions: - May be `&quot;&quot;`. - Must be valid UTF-8 bytes. - Must have values that match regex `[A-Za-z\d\.\-_]{1,100}` If the value of any dimension matches regex `__.*__`, the partition is reserved/read-only. A reserved/read-only partition ID is forbidden in certain documented contexts. Foreign partition IDs (in which the project ID does not match the context project ID ) are discouraged. Reads and writes of foreign partition IDs may fail if the project is not in an active state. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.
+                  &quot;namespaceId&quot;: &quot;A String&quot;, # If not empty, the ID of the namespace to which the entities belong.
+                  &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project to which the entities belong.
+                },
+                &quot;path&quot;: [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element&#x27;s _ancestors_. An entity path is always fully complete: *all* of the entity&#x27;s ancestors are required to be in the path along with the entity identifier itself. The only exception is that in some documented cases, the identifier in the last path element (for the entity) itself may be omitted. For example, the last path element of the key of `Mutation.insert` may have no identifier. A path can never be empty, and a path can have at most 100 elements.
+                  { # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.
+                    &quot;id&quot;: &quot;A String&quot;, # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.
+                    &quot;kind&quot;: &quot;A String&quot;, # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `&quot;&quot;`.
+                    &quot;name&quot;: &quot;A String&quot;, # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `&quot;&quot;`.
+                  },
+                ],
+              },
+              &quot;meaning&quot;: 42, # The `meaning` field should only be populated for backwards compatibility.
+              &quot;nullValue&quot;: &quot;A String&quot;, # A null value.
+              &quot;stringValue&quot;: &quot;A String&quot;, # A UTF-8 encoded string value. When `exclude_from_indexes` is false (it is indexed) , may have at most 1500 bytes. Otherwise, may be set to at most 1,000,000 bytes.
+              &quot;timestampValue&quot;: &quot;A String&quot;, # A timestamp value. When stored in the Datastore, precise only to microseconds; any additional precision is rounded down.
+            },
           },
         },
         &quot;version&quot;: &quot;A String&quot;, # The version of the entity, a strictly positive number that monotonically increases with changes to the entity. This field is set for `FULL` entity results. For missing entities in `LookupResponse`, this is the version of the snapshot that was used to look up the entity, and it is always set except for eventually consistent reads.
@@ -902,24 +1049,7 @@
           &quot;blobValue&quot;: &quot;A String&quot;, # A blob value. May have at most 1,000,000 bytes. When `exclude_from_indexes` is false, may have at most 1500 bytes. In JSON requests, must be base64-encoded.
           &quot;booleanValue&quot;: True or False, # A boolean value.
           &quot;doubleValue&quot;: 3.14, # A double value.
-          &quot;entityValue&quot;: { # A Datastore data object. An entity is limited to 1 megabyte when stored. That _roughly_ corresponds to a limit of 1 megabyte for the serialized form of this message. # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
-            &quot;key&quot;: { # A unique identifier for an entity. If a key&#x27;s partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # The entity&#x27;s key. An entity must have a key, unless otherwise documented (for example, an entity in `Value.entity_value` may have no key). An entity&#x27;s kind is its key path&#x27;s last element&#x27;s kind, or null if it has no key.
-              &quot;partitionId&quot;: { # A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. Partition dimensions: - May be `&quot;&quot;`. - Must be valid UTF-8 bytes. - Must have values that match regex `[A-Za-z\d\.\-_]{1,100}` If the value of any dimension matches regex `__.*__`, the partition is reserved/read-only. A reserved/read-only partition ID is forbidden in certain documented contexts. Foreign partition IDs (in which the project ID does not match the context project ID ) are discouraged. Reads and writes of foreign partition IDs may fail if the project is not in an active state. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.
-                &quot;namespaceId&quot;: &quot;A String&quot;, # If not empty, the ID of the namespace to which the entities belong.
-                &quot;projectId&quot;: &quot;A String&quot;, # The ID of the project to which the entities belong.
-              },
-              &quot;path&quot;: [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element&#x27;s _ancestors_. An entity path is always fully complete: *all* of the entity&#x27;s ancestors are required to be in the path along with the entity identifier itself. The only exception is that in some documented cases, the identifier in the last path element (for the entity) itself may be omitted. For example, the last path element of the key of `Mutation.insert` may have no identifier. A path can never be empty, and a path can have at most 100 elements.
-                { # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.
-                  &quot;id&quot;: &quot;A String&quot;, # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.
-                  &quot;kind&quot;: &quot;A String&quot;, # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `&quot;&quot;`.
-                  &quot;name&quot;: &quot;A String&quot;, # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `&quot;&quot;`.
-                },
-              ],
-            },
-            &quot;properties&quot;: { # The entity&#x27;s properties. The map&#x27;s keys are property names. A property name matching regex `__.*__` is reserved. A reserved property name is forbidden in certain documented contexts. The name must not contain more than 500 characters. The name cannot be `&quot;&quot;`.
-              &quot;a_key&quot;: # Object with schema name: Value
-            },
-          },
+          &quot;entityValue&quot;: # Object with schema name: Entity # An entity value. - May have no key. - May have a key with an incomplete key path. - May have a reserved/read-only key.
           &quot;excludeFromIndexes&quot;: True or False, # If the value should be excluded from all indexes including those defined explicitly.
           &quot;geoPointValue&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
             &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
diff --git a/docs/dyn/domains_v1alpha2.projects.locations.registrations.html b/docs/dyn/domains_v1alpha2.projects.locations.registrations.html
index f0db51f..a0da515 100644
--- a/docs/dyn/domains_v1alpha2.projects.locations.registrations.html
+++ b/docs/dyn/domains_v1alpha2.projects.locations.registrations.html
@@ -88,10 +88,10 @@
 <p class="firstline">Updates a `Registration`'s management settings.</p>
 <p class="toc_element">
   <code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>
-<p class="firstline">Deletes a `Registration` resource. This method only works on resources in one of the following states: * `state` is `EXPORTED` with `expire_time` in the past * `state` is `REGISTRATION_FAILED`</p>
+<p class="firstline">Deletes a `Registration` resource. For `Registration` resources , this method works if: * `state` is `EXPORTED` with `expire_time` in the past * `state` is `REGISTRATION_FAILED` When an active domain is successfully deleted, you can continue to use the domain in [Google Domains](https://domains.google/) until it expires. The calling user becomes the domain's sole owner in Google Domains, and permissions for the domain are subsequently managed there. The domain will not renew automatically unless the new owner sets up billing in Google Domains.</p>
 <p class="toc_element">
   <code><a href="#export">export(name, body=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Exports a `Registration` that you no longer want to use with Cloud Domains. You can continue to use the domain in [Google Domains](https://domains.google/) until it expires. If the export is successful: * The resource's `state` becomes `EXPORTED`, meaning that it is no longer managed by Cloud Domains * Because individual users can own domains in Google Domains, the calling user becomes the domain's sole owner. Permissions for the domain are subsequently managed in Google Domains. * Without further action, the domain does not renew automatically. The new owner can set up billing in Google Domains to renew the domain if needed.</p>
+<p class="firstline">Exports a `Registration` resource, such that it is no longer managed by Cloud Domains. When an active domain is successfully exported, you can continue to use the domain in [Google Domains](https://domains.google/) until it expires. The calling user becomes the domain's sole owner in Google Domains, and permissions for the domain are subsequently managed there. The domain will not renew automatically unless the new owner sets up billing in Google Domains.</p>
 <p class="toc_element">
   <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
 <p class="firstline">Gets the details of a `Registration` resource.</p>
@@ -380,7 +380,7 @@
 
 <div class="method">
     <code class="details" id="delete">delete(name, x__xgafv=None)</code>
-  <pre>Deletes a `Registration` resource. This method only works on resources in one of the following states: * `state` is `EXPORTED` with `expire_time` in the past * `state` is `REGISTRATION_FAILED`
+  <pre>Deletes a `Registration` resource. For `Registration` resources , this method works if: * `state` is `EXPORTED` with `expire_time` in the past * `state` is `REGISTRATION_FAILED` When an active domain is successfully deleted, you can continue to use the domain in [Google Domains](https://domains.google/) until it expires. The calling user becomes the domain&#x27;s sole owner in Google Domains, and permissions for the domain are subsequently managed there. The domain will not renew automatically unless the new owner sets up billing in Google Domains.
 
 Args:
   name: string, Required. The name of the `Registration` to delete, in the format `projects/*/locations/*/registrations/*`. (required)
@@ -415,7 +415,7 @@
 
 <div class="method">
     <code class="details" id="export">export(name, body=None, x__xgafv=None)</code>
-  <pre>Exports a `Registration` that you no longer want to use with Cloud Domains. You can continue to use the domain in [Google Domains](https://domains.google/) until it expires. If the export is successful: * The resource&#x27;s `state` becomes `EXPORTED`, meaning that it is no longer managed by Cloud Domains * Because individual users can own domains in Google Domains, the calling user becomes the domain&#x27;s sole owner. Permissions for the domain are subsequently managed in Google Domains. * Without further action, the domain does not renew automatically. The new owner can set up billing in Google Domains to renew the domain if needed.
+  <pre>Exports a `Registration` resource, such that it is no longer managed by Cloud Domains. When an active domain is successfully exported, you can continue to use the domain in [Google Domains](https://domains.google/) until it expires. The calling user becomes the domain&#x27;s sole owner in Google Domains, and permissions for the domain are subsequently managed there. The domain will not renew automatically unless the new owner sets up billing in Google Domains.
 
 Args:
   name: string, Required. The name of the `Registration` to export, in the format `projects/*/locations/*/registrations/*`. (required)
@@ -683,7 +683,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
@@ -1565,7 +1565,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
@@ -1607,7 +1607,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
diff --git a/docs/dyn/domains_v1beta1.projects.locations.registrations.html b/docs/dyn/domains_v1beta1.projects.locations.registrations.html
index f0d3ba2..9f51fb3 100644
--- a/docs/dyn/domains_v1beta1.projects.locations.registrations.html
+++ b/docs/dyn/domains_v1beta1.projects.locations.registrations.html
@@ -88,10 +88,10 @@
 <p class="firstline">Updates a `Registration`'s management settings.</p>
 <p class="toc_element">
   <code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>
-<p class="firstline">Deletes a `Registration` resource. This method only works on resources in one of the following states: * `state` is `EXPORTED` with `expire_time` in the past * `state` is `REGISTRATION_FAILED`</p>
+<p class="firstline">Deletes a `Registration` resource. For `Registration` resources using usage billing, this method works if: * `state` is `EXPORTED` with `expire_time` in the past * `state` is `REGISTRATION_FAILED` * `state` is `TRANSFER_FAILED` This method works on any `Registration` resource using subscription billing, provided that the resource was created at least 1 day in the past. When an active domain is successfully deleted, you can continue to use the domain in [Google Domains](https://domains.google/) until it expires. The calling user becomes the domain's sole owner in Google Domains, and permissions for the domain are subsequently managed there. The domain will not renew automatically unless the new owner sets up billing in Google Domains.</p>
 <p class="toc_element">
   <code><a href="#export">export(name, body=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Exports a `Registration` that you no longer want to use with Cloud Domains. You can continue to use the domain in [Google Domains](https://domains.google/) until it expires. If the export is successful: * The resource's `state` becomes `EXPORTED`, meaning that it is no longer managed by Cloud Domains * Because individual users can own domains in Google Domains, the calling user becomes the domain's sole owner. Permissions for the domain are subsequently managed in Google Domains. * Without further action, the domain does not renew automatically. The new owner can set up billing in Google Domains to renew the domain if needed.</p>
+<p class="firstline">Exports a `Registration` resource, such that it is no longer managed by Cloud Domains. When an active domain is successfully exported, you can continue to use the domain in [Google Domains](https://domains.google/) until it expires. The calling user becomes the domain's sole owner in Google Domains, and permissions for the domain are subsequently managed there. The domain will not renew automatically unless the new owner sets up billing in Google Domains.</p>
 <p class="toc_element">
   <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
 <p class="firstline">Gets the details of a `Registration` resource.</p>
@@ -120,6 +120,9 @@
   <code><a href="#retrieveRegisterParameters">retrieveRegisterParameters(location, domainName=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Gets parameters needed to register a new domain name, including price and up-to-date availability. Use the returned values to call `RegisterDomain`.</p>
 <p class="toc_element">
+  <code><a href="#retrieveTransferParameters">retrieveTransferParameters(location, domainName=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets parameters needed to transfer a domain name from another registrar to Cloud Domains. For domains managed by Google Domains, transferring to Cloud Domains is not yet supported. Use the returned values to call `TransferDomain`.</p>
+<p class="toc_element">
   <code><a href="#searchDomains">searchDomains(location, query=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Searches for available domain names similar to the provided query. Availability results from this method are approximate; call `RetrieveRegisterParameters` on a domain before registering to confirm availability.</p>
 <p class="toc_element">
@@ -128,6 +131,9 @@
 <p class="toc_element">
   <code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may "fail open" without warning.</p>
+<p class="toc_element">
+  <code><a href="#transfer">transfer(parent, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Transfers a domain name from another registrar to Cloud Domains. For domains managed by Google Domains, transferring to Cloud Domains is not yet supported. Before calling this method, go to the domain's current registrar to unlock the domain for transfer and retrieve the domain's transfer authorization code. Then call `RetrieveTransferParameters` to confirm that the domain is unlocked and to get values needed to build a call to this method. A successful call creates a `Registration` resource in state `TRANSFER_PENDING`. It can take several days to complete the transfer process. The registrant can often speed up this process by approving the transfer through the current registrar, either by clicking a link in an email from the registrar or by visiting the registrar's website. A few minutes after transfer approval, the resource transitions to state `ACTIVE`, indicating that the transfer was successful. If the transfer is rejected or the request expires without being approved, the resource can end up in state `TRANSFER_FAILED`. If transfer fails, you can safely delete the resource and retry the transfer.</p>
 <h3>Method Details</h3>
 <div class="method">
     <code class="details" id="close">close()</code>
@@ -380,7 +386,7 @@
 
 <div class="method">
     <code class="details" id="delete">delete(name, x__xgafv=None)</code>
-  <pre>Deletes a `Registration` resource. This method only works on resources in one of the following states: * `state` is `EXPORTED` with `expire_time` in the past * `state` is `REGISTRATION_FAILED`
+  <pre>Deletes a `Registration` resource. For `Registration` resources using usage billing, this method works if: * `state` is `EXPORTED` with `expire_time` in the past * `state` is `REGISTRATION_FAILED` * `state` is `TRANSFER_FAILED` This method works on any `Registration` resource using subscription billing, provided that the resource was created at least 1 day in the past. When an active domain is successfully deleted, you can continue to use the domain in [Google Domains](https://domains.google/) until it expires. The calling user becomes the domain&#x27;s sole owner in Google Domains, and permissions for the domain are subsequently managed there. The domain will not renew automatically unless the new owner sets up billing in Google Domains.
 
 Args:
   name: string, Required. The name of the `Registration` to delete, in the format `projects/*/locations/*/registrations/*`. (required)
@@ -415,7 +421,7 @@
 
 <div class="method">
     <code class="details" id="export">export(name, body=None, x__xgafv=None)</code>
-  <pre>Exports a `Registration` that you no longer want to use with Cloud Domains. You can continue to use the domain in [Google Domains](https://domains.google/) until it expires. If the export is successful: * The resource&#x27;s `state` becomes `EXPORTED`, meaning that it is no longer managed by Cloud Domains * Because individual users can own domains in Google Domains, the calling user becomes the domain&#x27;s sole owner. Permissions for the domain are subsequently managed in Google Domains. * Without further action, the domain does not renew automatically. The new owner can set up billing in Google Domains to renew the domain if needed.
+  <pre>Exports a `Registration` resource, such that it is no longer managed by Cloud Domains. When an active domain is successfully exported, you can continue to use the domain in [Google Domains](https://domains.google/) until it expires. The calling user becomes the domain&#x27;s sole owner in Google Domains, and permissions for the domain are subsequently managed there. The domain will not renew automatically unless the new owner sets up billing in Google Domains.
 
 Args:
   name: string, Required. The name of the `Registration` to export, in the format `projects/*/locations/*/registrations/*`. (required)
@@ -468,7 +474,7 @@
 Returns:
   An object of the form:
 
-    { # The `Registration` resource facilitates managing and configuring domain name registrations. To create a new `Registration` resource, find a suitable domain name by calling the `SearchDomains` method with a query to see available domain name options. After choosing a name, call `RetrieveRegisterParameters` to ensure availability and obtain information like pricing, which is needed to build a call to `RegisterDomain`.
+    { # The `Registration` resource facilitates managing and configuring domain name registrations. There are several ways to create a new `Registration` resource: To create a new `Registration` resource, find a suitable domain name by calling the `SearchDomains` method with a query to see available domain name options. After choosing a name, call `RetrieveRegisterParameters` to ensure availability and obtain information like pricing, which is needed to build a call to `RegisterDomain`. Another way to create a new `Registration` is to transfer an existing domain from another registrar. First, go to the current registrar to unlock the domain for transfer and retrieve the domain&#x27;s transfer authorization code. Then call `RetrieveTransferParameters` to confirm that the domain is unlocked and to get values needed to build a call to `TransferDomain`.
   &quot;contactSettings&quot;: { # Defines the contact information associated with a `Registration`. [ICANN](https://icann.org/) requires all domain names to have associated contact information. The `registrant_contact` is considered the domain&#x27;s legal owner, and often the other contacts are identical. # Required. Settings for contact information linked to the `Registration`. You cannot update these with the `UpdateRegistration` method. To update these settings, use the `ConfigureContactSettings` method.
     &quot;adminContact&quot;: { # Details required for a contact associated with a `Registration`. # Required. The administrative contact for the `Registration`.
       &quot;email&quot;: &quot;A String&quot;, # Required. Email address of the contact.
@@ -683,7 +689,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
@@ -697,7 +703,7 @@
       &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
     },
   ],
-  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member. The `bindings` in a `Policy` can refer to up to 1,500 members; up to 250 of these members can be Google groups. Each occurrence of a member counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other member, then you can add another 1,450 members to the `bindings` in the `Policy`.
     { # Associates `members` with a `role`.
       &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
         &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
@@ -736,7 +742,7 @@
     { # Response for the `ListRegistrations` method.
   &quot;nextPageToken&quot;: &quot;A String&quot;, # When present, there are more results to retrieve. Set `page_token` to this value on a subsequent call to get the next page of results.
   &quot;registrations&quot;: [ # A list of `Registration`s.
-    { # The `Registration` resource facilitates managing and configuring domain name registrations. To create a new `Registration` resource, find a suitable domain name by calling the `SearchDomains` method with a query to see available domain name options. After choosing a name, call `RetrieveRegisterParameters` to ensure availability and obtain information like pricing, which is needed to build a call to `RegisterDomain`.
+    { # The `Registration` resource facilitates managing and configuring domain name registrations. There are several ways to create a new `Registration` resource: To create a new `Registration` resource, find a suitable domain name by calling the `SearchDomains` method with a query to see available domain name options. After choosing a name, call `RetrieveRegisterParameters` to ensure availability and obtain information like pricing, which is needed to build a call to `RegisterDomain`. Another way to create a new `Registration` is to transfer an existing domain from another registrar. First, go to the current registrar to unlock the domain for transfer and retrieve the domain&#x27;s transfer authorization code. Then call `RetrieveTransferParameters` to confirm that the domain is unlocked and to get values needed to build a call to `TransferDomain`.
       &quot;contactSettings&quot;: { # Defines the contact information associated with a `Registration`. [ICANN](https://icann.org/) requires all domain names to have associated contact information. The `registrant_contact` is considered the domain&#x27;s legal owner, and often the other contacts are identical. # Required. Settings for contact information linked to the `Registration`. You cannot update these with the `UpdateRegistration` method. To update these settings, use the `ConfigureContactSettings` method.
         &quot;adminContact&quot;: { # Details required for a contact associated with a `Registration`. # Required. The administrative contact for the `Registration`.
           &quot;email&quot;: &quot;A String&quot;, # Required. Email address of the contact.
@@ -961,7 +967,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # The `Registration` resource facilitates managing and configuring domain name registrations. To create a new `Registration` resource, find a suitable domain name by calling the `SearchDomains` method with a query to see available domain name options. After choosing a name, call `RetrieveRegisterParameters` to ensure availability and obtain information like pricing, which is needed to build a call to `RegisterDomain`.
+{ # The `Registration` resource facilitates managing and configuring domain name registrations. There are several ways to create a new `Registration` resource: To create a new `Registration` resource, find a suitable domain name by calling the `SearchDomains` method with a query to see available domain name options. After choosing a name, call `RetrieveRegisterParameters` to ensure availability and obtain information like pricing, which is needed to build a call to `RegisterDomain`. Another way to create a new `Registration` is to transfer an existing domain from another registrar. First, go to the current registrar to unlock the domain for transfer and retrieve the domain&#x27;s transfer authorization code. Then call `RetrieveTransferParameters` to confirm that the domain is unlocked and to get values needed to build a call to `TransferDomain`.
   &quot;contactSettings&quot;: { # Defines the contact information associated with a `Registration`. [ICANN](https://icann.org/) requires all domain names to have associated contact information. The `registrant_contact` is considered the domain&#x27;s legal owner, and often the other contacts are identical. # Required. Settings for contact information linked to the `Registration`. You cannot update these with the `UpdateRegistration` method. To update these settings, use the `ConfigureContactSettings` method.
     &quot;adminContact&quot;: { # Details required for a contact associated with a `Registration`. # Required. The administrative contact for the `Registration`.
       &quot;email&quot;: &quot;A String&quot;, # Required. Email address of the contact.
@@ -1206,7 +1212,7 @@
   &quot;domainNotices&quot;: [ # The list of domain notices that you acknowledge. Call `RetrieveRegisterParameters` to see the notices that need acknowledgement.
     &quot;A String&quot;,
   ],
-  &quot;registration&quot;: { # The `Registration` resource facilitates managing and configuring domain name registrations. To create a new `Registration` resource, find a suitable domain name by calling the `SearchDomains` method with a query to see available domain name options. After choosing a name, call `RetrieveRegisterParameters` to ensure availability and obtain information like pricing, which is needed to build a call to `RegisterDomain`. # Required. The complete `Registration` resource to be created.
+  &quot;registration&quot;: { # The `Registration` resource facilitates managing and configuring domain name registrations. There are several ways to create a new `Registration` resource: To create a new `Registration` resource, find a suitable domain name by calling the `SearchDomains` method with a query to see available domain name options. After choosing a name, call `RetrieveRegisterParameters` to ensure availability and obtain information like pricing, which is needed to build a call to `RegisterDomain`. Another way to create a new `Registration` is to transfer an existing domain from another registrar. First, go to the current registrar to unlock the domain for transfer and retrieve the domain&#x27;s transfer authorization code. Then call `RetrieveTransferParameters` to confirm that the domain is unlocked and to get values needed to build a call to `TransferDomain`. # Required. The complete `Registration` resource to be created.
     &quot;contactSettings&quot;: { # Defines the contact information associated with a `Registration`. [ICANN](https://icann.org/) requires all domain names to have associated contact information. The `registrant_contact` is considered the domain&#x27;s legal owner, and often the other contacts are identical. # Required. Settings for contact information linked to the `Registration`. You cannot update these with the `UpdateRegistration` method. To update these settings, use the `ConfigureContactSettings` method.
       &quot;adminContact&quot;: { # Details required for a contact associated with a `Registration`. # Required. The administrative contact for the `Registration`.
         &quot;email&quot;: &quot;A String&quot;, # Required. Email address of the contact.
@@ -1520,6 +1526,41 @@
 </div>
 
 <div class="method">
+    <code class="details" id="retrieveTransferParameters">retrieveTransferParameters(location, domainName=None, x__xgafv=None)</code>
+  <pre>Gets parameters needed to transfer a domain name from another registrar to Cloud Domains. For domains managed by Google Domains, transferring to Cloud Domains is not yet supported. Use the returned values to call `TransferDomain`.
+
+Args:
+  location: string, Required. The location. Must be in the format `projects/*/locations/*`. (required)
+  domainName: string, Required. The domain name. Unicode domain names must be expressed in Punycode format.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Response for the `RetrieveTransferParameters` method.
+  &quot;transferParameters&quot;: { # Parameters required to transfer a domain from another registrar. # Parameters to use when calling the `TransferDomain` method.
+    &quot;currentRegistrar&quot;: &quot;A String&quot;, # The registrar that currently manages the domain.
+    &quot;domainName&quot;: &quot;A String&quot;, # The domain name. Unicode domain names are expressed in Punycode format.
+    &quot;nameServers&quot;: [ # The name servers that currently store the configuration of the domain.
+      &quot;A String&quot;,
+    ],
+    &quot;supportedPrivacy&quot;: [ # Contact privacy options that the domain supports.
+      &quot;A String&quot;,
+    ],
+    &quot;transferLockState&quot;: &quot;A String&quot;, # Indicates whether the domain is protected by a transfer lock. For a transfer to succeed, this must show `UNLOCKED`. To unlock a domain, go to its current registrar.
+    &quot;yearlyPrice&quot;: { # Represents an amount of money with its currency type. # Price to transfer or renew the domain for one year.
+      &quot;currencyCode&quot;: &quot;A String&quot;, # The three-letter currency code defined in ISO 4217.
+      &quot;nanos&quot;: 42, # Number of nano (10^-9) units of the amount. The value must be between -999,999,999 and +999,999,999 inclusive. If `units` is positive, `nanos` must be positive or zero. If `units` is zero, `nanos` can be positive, zero, or negative. If `units` is negative, `nanos` must be negative or zero. For example $-1.75 is represented as `units`=-1 and `nanos`=-750,000,000.
+      &quot;units&quot;: &quot;A String&quot;, # The whole units of the amount. For example if `currencyCode` is `&quot;USD&quot;`, then 1 unit is one US dollar.
+    },
+  },
+}</pre>
+</div>
+
+<div class="method">
     <code class="details" id="searchDomains">searchDomains(location, query=None, x__xgafv=None)</code>
   <pre>Searches for available domain names similar to the provided query. Availability results from this method are approximate; call `RetrieveRegisterParameters` on a domain before registering to confirm availability.
 
@@ -1565,7 +1606,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
@@ -1579,7 +1620,7 @@
         &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
       },
     ],
-    &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+    &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member. The `bindings` in a `Policy` can refer to up to 1,500 members; up to 250 of these members can be Google groups. Each occurrence of a member counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other member, then you can add another 1,450 members to the `bindings` in the `Policy`.
       { # Associates `members` with a `role`.
         &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
           &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
@@ -1607,7 +1648,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
@@ -1621,7 +1662,7 @@
       &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
     },
   ],
-  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member. The `bindings` in a `Policy` can refer to up to 1,500 members; up to 250 of these members can be Google groups. Each occurrence of a member counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other member, then you can add another 1,450 members to the `bindings` in the `Policy`.
     { # Associates `members` with a `role`.
       &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
         &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
@@ -1670,4 +1711,255 @@
 }</pre>
 </div>
 
+<div class="method">
+    <code class="details" id="transfer">transfer(parent, body=None, x__xgafv=None)</code>
+  <pre>Transfers a domain name from another registrar to Cloud Domains. For domains managed by Google Domains, transferring to Cloud Domains is not yet supported. Before calling this method, go to the domain&#x27;s current registrar to unlock the domain for transfer and retrieve the domain&#x27;s transfer authorization code. Then call `RetrieveTransferParameters` to confirm that the domain is unlocked and to get values needed to build a call to this method. A successful call creates a `Registration` resource in state `TRANSFER_PENDING`. It can take several days to complete the transfer process. The registrant can often speed up this process by approving the transfer through the current registrar, either by clicking a link in an email from the registrar or by visiting the registrar&#x27;s website. A few minutes after transfer approval, the resource transitions to state `ACTIVE`, indicating that the transfer was successful. If the transfer is rejected or the request expires without being approved, the resource can end up in state `TRANSFER_FAILED`. If transfer fails, you can safely delete the resource and retry the transfer.
+
+Args:
+  parent: string, Required. The parent resource of the `Registration`. Must be in the format `projects/*/locations/*`. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Request for the `TransferDomain` method.
+  &quot;authorizationCode&quot;: { # Defines an authorization code. # The domain&#x27;s transfer authorization code. You can obtain this from the domain&#x27;s current registrar.
+    &quot;code&quot;: &quot;A String&quot;, # The Authorization Code in ASCII. It can be used to transfer the domain to or from another registrar.
+  },
+  &quot;contactNotices&quot;: [ # The list of contact notices that you acknowledge. The notices needed here depend on the values specified in `registration.contact_settings`.
+    &quot;A String&quot;,
+  ],
+  &quot;registration&quot;: { # The `Registration` resource facilitates managing and configuring domain name registrations. There are several ways to create a new `Registration` resource: To create a new `Registration` resource, find a suitable domain name by calling the `SearchDomains` method with a query to see available domain name options. After choosing a name, call `RetrieveRegisterParameters` to ensure availability and obtain information like pricing, which is needed to build a call to `RegisterDomain`. Another way to create a new `Registration` is to transfer an existing domain from another registrar. First, go to the current registrar to unlock the domain for transfer and retrieve the domain&#x27;s transfer authorization code. Then call `RetrieveTransferParameters` to confirm that the domain is unlocked and to get values needed to build a call to `TransferDomain`. # Required. The complete `Registration` resource to be created. You can leave `registration.dns_settings` unset to import the domain&#x27;s current DNS configuration from its current registrar. Use this option only if you are sure that the domain&#x27;s current DNS service will not cease upon transfer, as is often the case for DNS services provided for free by the registrar.
+    &quot;contactSettings&quot;: { # Defines the contact information associated with a `Registration`. [ICANN](https://icann.org/) requires all domain names to have associated contact information. The `registrant_contact` is considered the domain&#x27;s legal owner, and often the other contacts are identical. # Required. Settings for contact information linked to the `Registration`. You cannot update these with the `UpdateRegistration` method. To update these settings, use the `ConfigureContactSettings` method.
+      &quot;adminContact&quot;: { # Details required for a contact associated with a `Registration`. # Required. The administrative contact for the `Registration`.
+        &quot;email&quot;: &quot;A String&quot;, # Required. Email address of the contact.
+        &quot;faxNumber&quot;: &quot;A String&quot;, # Fax number of the contact in international format. For example, `&quot;+1-800-555-0123&quot;`.
+        &quot;phoneNumber&quot;: &quot;A String&quot;, # Required. Phone number of the contact in international format. For example, `&quot;+1-800-555-0123&quot;`.
+        &quot;postalAddress&quot;: { # Represents a postal address, e.g. for postal delivery or payments addresses. Given a postal address, a postal service can deliver items to a premise, P.O. Box or similar. It is not intended to model geographical locations (roads, towns, mountains). In typical usage an address would be created via user input or from importing existing data, depending on the type of process. Advice on address input / editing: - Use an i18n-ready address widget such as https://github.com/google/libaddressinput) - Users should not be presented with UI elements for input or editing of fields outside countries where that field is used. For more guidance on how to use this schema, please see: https://support.google.com/business/answer/6397478 # Required. Postal address of the contact.
+          &quot;addressLines&quot;: [ # Unstructured address lines describing the lower levels of an address. Because values in address_lines do not have type information and may sometimes contain multiple values in a single field (e.g. &quot;Austin, TX&quot;), it is important that the line order is clear. The order of address lines should be &quot;envelope order&quot; for the country/region of the address. In places where this can vary (e.g. Japan), address_language is used to make it explicit (e.g. &quot;ja&quot; for large-to-small ordering and &quot;ja-Latn&quot; or &quot;en&quot; for small-to-large). This way, the most specific line of an address can be selected based on the language. The minimum permitted structural representation of an address consists of a region_code with all remaining information placed in the address_lines. It would be possible to format such an address very approximately without geocoding, but no semantic reasoning could be made about any of the address components until it was at least partially resolved. Creating an address only containing a region_code and address_lines, and then geocoding is the recommended way to handle completely unstructured addresses (as opposed to guessing which parts of the address should be localities or administrative areas).
+            &quot;A String&quot;,
+          ],
+          &quot;administrativeArea&quot;: &quot;A String&quot;, # Optional. Highest administrative subdivision which is used for postal addresses of a country or region. For example, this can be a state, a province, an oblast, or a prefecture. Specifically, for Spain this is the province and not the autonomous community (e.g. &quot;Barcelona&quot; and not &quot;Catalonia&quot;). Many countries don&#x27;t use an administrative area in postal addresses. E.g. in Switzerland this should be left unpopulated.
+          &quot;languageCode&quot;: &quot;A String&quot;, # Optional. BCP-47 language code of the contents of this address (if known). This is often the UI language of the input form or is expected to match one of the languages used in the address&#x27; country/region, or their transliterated equivalents. This can affect formatting in certain countries, but is not critical to the correctness of the data and will never affect any validation or other non-formatting related operations. If this value is not known, it should be omitted (rather than specifying a possibly incorrect default). Examples: &quot;zh-Hant&quot;, &quot;ja&quot;, &quot;ja-Latn&quot;, &quot;en&quot;.
+          &quot;locality&quot;: &quot;A String&quot;, # Optional. Generally refers to the city/town portion of the address. Examples: US city, IT comune, UK post town. In regions of the world where localities are not well defined or do not fit into this structure well, leave locality empty and use address_lines.
+          &quot;organization&quot;: &quot;A String&quot;, # Optional. The name of the organization at the address.
+          &quot;postalCode&quot;: &quot;A String&quot;, # Optional. Postal code of the address. Not all countries use or require postal codes to be present, but where they are used, they may trigger additional validation with other parts of the address (e.g. state/zip validation in the U.S.A.).
+          &quot;recipients&quot;: [ # Optional. The recipient at the address. This field may, under certain circumstances, contain multiline information. For example, it might contain &quot;care of&quot; information.
+            &quot;A String&quot;,
+          ],
+          &quot;regionCode&quot;: &quot;A String&quot;, # Required. CLDR region code of the country/region of the address. This is never inferred and it is up to the user to ensure the value is correct. See http://cldr.unicode.org/ and http://www.unicode.org/cldr/charts/30/supplemental/territory_information.html for details. Example: &quot;CH&quot; for Switzerland.
+          &quot;revision&quot;: 42, # The schema revision of the `PostalAddress`. This must be set to 0, which is the latest revision. All new revisions **must** be backward compatible with old revisions.
+          &quot;sortingCode&quot;: &quot;A String&quot;, # Optional. Additional, country-specific, sorting code. This is not used in most regions. Where it is used, the value is either a string like &quot;CEDEX&quot;, optionally followed by a number (e.g. &quot;CEDEX 7&quot;), or just a number alone, representing the &quot;sector code&quot; (Jamaica), &quot;delivery area indicator&quot; (Malawi) or &quot;post office indicator&quot; (e.g. Côte d&#x27;Ivoire).
+          &quot;sublocality&quot;: &quot;A String&quot;, # Optional. Sublocality of the address. For example, this can be neighborhoods, boroughs, districts.
+        },
+      },
+      &quot;privacy&quot;: &quot;A String&quot;, # Required. Privacy setting for the contacts associated with the `Registration`.
+      &quot;registrantContact&quot;: { # Details required for a contact associated with a `Registration`. # Required. The registrant contact for the `Registration`. *Caution: Anyone with access to this email address, phone number, and/or postal address can take control of the domain.* *Warning: For new `Registration`s, the registrant will receive an email confirmation that they must complete within 15 days to avoid domain suspension.*
+        &quot;email&quot;: &quot;A String&quot;, # Required. Email address of the contact.
+        &quot;faxNumber&quot;: &quot;A String&quot;, # Fax number of the contact in international format. For example, `&quot;+1-800-555-0123&quot;`.
+        &quot;phoneNumber&quot;: &quot;A String&quot;, # Required. Phone number of the contact in international format. For example, `&quot;+1-800-555-0123&quot;`.
+        &quot;postalAddress&quot;: { # Represents a postal address, e.g. for postal delivery or payments addresses. Given a postal address, a postal service can deliver items to a premise, P.O. Box or similar. It is not intended to model geographical locations (roads, towns, mountains). In typical usage an address would be created via user input or from importing existing data, depending on the type of process. Advice on address input / editing: - Use an i18n-ready address widget such as https://github.com/google/libaddressinput) - Users should not be presented with UI elements for input or editing of fields outside countries where that field is used. For more guidance on how to use this schema, please see: https://support.google.com/business/answer/6397478 # Required. Postal address of the contact.
+          &quot;addressLines&quot;: [ # Unstructured address lines describing the lower levels of an address. Because values in address_lines do not have type information and may sometimes contain multiple values in a single field (e.g. &quot;Austin, TX&quot;), it is important that the line order is clear. The order of address lines should be &quot;envelope order&quot; for the country/region of the address. In places where this can vary (e.g. Japan), address_language is used to make it explicit (e.g. &quot;ja&quot; for large-to-small ordering and &quot;ja-Latn&quot; or &quot;en&quot; for small-to-large). This way, the most specific line of an address can be selected based on the language. The minimum permitted structural representation of an address consists of a region_code with all remaining information placed in the address_lines. It would be possible to format such an address very approximately without geocoding, but no semantic reasoning could be made about any of the address components until it was at least partially resolved. Creating an address only containing a region_code and address_lines, and then geocoding is the recommended way to handle completely unstructured addresses (as opposed to guessing which parts of the address should be localities or administrative areas).
+            &quot;A String&quot;,
+          ],
+          &quot;administrativeArea&quot;: &quot;A String&quot;, # Optional. Highest administrative subdivision which is used for postal addresses of a country or region. For example, this can be a state, a province, an oblast, or a prefecture. Specifically, for Spain this is the province and not the autonomous community (e.g. &quot;Barcelona&quot; and not &quot;Catalonia&quot;). Many countries don&#x27;t use an administrative area in postal addresses. E.g. in Switzerland this should be left unpopulated.
+          &quot;languageCode&quot;: &quot;A String&quot;, # Optional. BCP-47 language code of the contents of this address (if known). This is often the UI language of the input form or is expected to match one of the languages used in the address&#x27; country/region, or their transliterated equivalents. This can affect formatting in certain countries, but is not critical to the correctness of the data and will never affect any validation or other non-formatting related operations. If this value is not known, it should be omitted (rather than specifying a possibly incorrect default). Examples: &quot;zh-Hant&quot;, &quot;ja&quot;, &quot;ja-Latn&quot;, &quot;en&quot;.
+          &quot;locality&quot;: &quot;A String&quot;, # Optional. Generally refers to the city/town portion of the address. Examples: US city, IT comune, UK post town. In regions of the world where localities are not well defined or do not fit into this structure well, leave locality empty and use address_lines.
+          &quot;organization&quot;: &quot;A String&quot;, # Optional. The name of the organization at the address.
+          &quot;postalCode&quot;: &quot;A String&quot;, # Optional. Postal code of the address. Not all countries use or require postal codes to be present, but where they are used, they may trigger additional validation with other parts of the address (e.g. state/zip validation in the U.S.A.).
+          &quot;recipients&quot;: [ # Optional. The recipient at the address. This field may, under certain circumstances, contain multiline information. For example, it might contain &quot;care of&quot; information.
+            &quot;A String&quot;,
+          ],
+          &quot;regionCode&quot;: &quot;A String&quot;, # Required. CLDR region code of the country/region of the address. This is never inferred and it is up to the user to ensure the value is correct. See http://cldr.unicode.org/ and http://www.unicode.org/cldr/charts/30/supplemental/territory_information.html for details. Example: &quot;CH&quot; for Switzerland.
+          &quot;revision&quot;: 42, # The schema revision of the `PostalAddress`. This must be set to 0, which is the latest revision. All new revisions **must** be backward compatible with old revisions.
+          &quot;sortingCode&quot;: &quot;A String&quot;, # Optional. Additional, country-specific, sorting code. This is not used in most regions. Where it is used, the value is either a string like &quot;CEDEX&quot;, optionally followed by a number (e.g. &quot;CEDEX 7&quot;), or just a number alone, representing the &quot;sector code&quot; (Jamaica), &quot;delivery area indicator&quot; (Malawi) or &quot;post office indicator&quot; (e.g. Côte d&#x27;Ivoire).
+          &quot;sublocality&quot;: &quot;A String&quot;, # Optional. Sublocality of the address. For example, this can be neighborhoods, boroughs, districts.
+        },
+      },
+      &quot;technicalContact&quot;: { # Details required for a contact associated with a `Registration`. # Required. The technical contact for the `Registration`.
+        &quot;email&quot;: &quot;A String&quot;, # Required. Email address of the contact.
+        &quot;faxNumber&quot;: &quot;A String&quot;, # Fax number of the contact in international format. For example, `&quot;+1-800-555-0123&quot;`.
+        &quot;phoneNumber&quot;: &quot;A String&quot;, # Required. Phone number of the contact in international format. For example, `&quot;+1-800-555-0123&quot;`.
+        &quot;postalAddress&quot;: { # Represents a postal address, e.g. for postal delivery or payments addresses. Given a postal address, a postal service can deliver items to a premise, P.O. Box or similar. It is not intended to model geographical locations (roads, towns, mountains). In typical usage an address would be created via user input or from importing existing data, depending on the type of process. Advice on address input / editing: - Use an i18n-ready address widget such as https://github.com/google/libaddressinput) - Users should not be presented with UI elements for input or editing of fields outside countries where that field is used. For more guidance on how to use this schema, please see: https://support.google.com/business/answer/6397478 # Required. Postal address of the contact.
+          &quot;addressLines&quot;: [ # Unstructured address lines describing the lower levels of an address. Because values in address_lines do not have type information and may sometimes contain multiple values in a single field (e.g. &quot;Austin, TX&quot;), it is important that the line order is clear. The order of address lines should be &quot;envelope order&quot; for the country/region of the address. In places where this can vary (e.g. Japan), address_language is used to make it explicit (e.g. &quot;ja&quot; for large-to-small ordering and &quot;ja-Latn&quot; or &quot;en&quot; for small-to-large). This way, the most specific line of an address can be selected based on the language. The minimum permitted structural representation of an address consists of a region_code with all remaining information placed in the address_lines. It would be possible to format such an address very approximately without geocoding, but no semantic reasoning could be made about any of the address components until it was at least partially resolved. Creating an address only containing a region_code and address_lines, and then geocoding is the recommended way to handle completely unstructured addresses (as opposed to guessing which parts of the address should be localities or administrative areas).
+            &quot;A String&quot;,
+          ],
+          &quot;administrativeArea&quot;: &quot;A String&quot;, # Optional. Highest administrative subdivision which is used for postal addresses of a country or region. For example, this can be a state, a province, an oblast, or a prefecture. Specifically, for Spain this is the province and not the autonomous community (e.g. &quot;Barcelona&quot; and not &quot;Catalonia&quot;). Many countries don&#x27;t use an administrative area in postal addresses. E.g. in Switzerland this should be left unpopulated.
+          &quot;languageCode&quot;: &quot;A String&quot;, # Optional. BCP-47 language code of the contents of this address (if known). This is often the UI language of the input form or is expected to match one of the languages used in the address&#x27; country/region, or their transliterated equivalents. This can affect formatting in certain countries, but is not critical to the correctness of the data and will never affect any validation or other non-formatting related operations. If this value is not known, it should be omitted (rather than specifying a possibly incorrect default). Examples: &quot;zh-Hant&quot;, &quot;ja&quot;, &quot;ja-Latn&quot;, &quot;en&quot;.
+          &quot;locality&quot;: &quot;A String&quot;, # Optional. Generally refers to the city/town portion of the address. Examples: US city, IT comune, UK post town. In regions of the world where localities are not well defined or do not fit into this structure well, leave locality empty and use address_lines.
+          &quot;organization&quot;: &quot;A String&quot;, # Optional. The name of the organization at the address.
+          &quot;postalCode&quot;: &quot;A String&quot;, # Optional. Postal code of the address. Not all countries use or require postal codes to be present, but where they are used, they may trigger additional validation with other parts of the address (e.g. state/zip validation in the U.S.A.).
+          &quot;recipients&quot;: [ # Optional. The recipient at the address. This field may, under certain circumstances, contain multiline information. For example, it might contain &quot;care of&quot; information.
+            &quot;A String&quot;,
+          ],
+          &quot;regionCode&quot;: &quot;A String&quot;, # Required. CLDR region code of the country/region of the address. This is never inferred and it is up to the user to ensure the value is correct. See http://cldr.unicode.org/ and http://www.unicode.org/cldr/charts/30/supplemental/territory_information.html for details. Example: &quot;CH&quot; for Switzerland.
+          &quot;revision&quot;: 42, # The schema revision of the `PostalAddress`. This must be set to 0, which is the latest revision. All new revisions **must** be backward compatible with old revisions.
+          &quot;sortingCode&quot;: &quot;A String&quot;, # Optional. Additional, country-specific, sorting code. This is not used in most regions. Where it is used, the value is either a string like &quot;CEDEX&quot;, optionally followed by a number (e.g. &quot;CEDEX 7&quot;), or just a number alone, representing the &quot;sector code&quot; (Jamaica), &quot;delivery area indicator&quot; (Malawi) or &quot;post office indicator&quot; (e.g. Côte d&#x27;Ivoire).
+          &quot;sublocality&quot;: &quot;A String&quot;, # Optional. Sublocality of the address. For example, this can be neighborhoods, boroughs, districts.
+        },
+      },
+    },
+    &quot;createTime&quot;: &quot;A String&quot;, # Output only. The creation timestamp of the `Registration` resource.
+    &quot;dnsSettings&quot;: { # Defines the DNS configuration of a `Registration`, including name servers, DNSSEC, and glue records. # Settings controlling the DNS configuration of the `Registration`. You cannot update these with the `UpdateRegistration` method. To update these settings, use the `ConfigureDnsSettings` method.
+      &quot;customDns&quot;: { # Configuration for an arbitrary DNS provider. # An arbitrary DNS provider identified by its name servers.
+        &quot;dsRecords&quot;: [ # The list of DS records for this domain, which are used to enable DNSSEC. The domain&#x27;s DNS provider can provide the values to set here. If this field is empty, DNSSEC is disabled.
+          { # Defines a Delegation Signer (DS) record, which is needed to enable DNSSEC for a domain. It contains a digest (hash) of a DNSKEY record that must be present in the domain&#x27;s DNS zone.
+            &quot;algorithm&quot;: &quot;A String&quot;, # The algorithm used to generate the referenced DNSKEY.
+            &quot;digest&quot;: &quot;A String&quot;, # The digest generated from the referenced DNSKEY.
+            &quot;digestType&quot;: &quot;A String&quot;, # The hash function used to generate the digest of the referenced DNSKEY.
+            &quot;keyTag&quot;: 42, # The key tag of the record. Must be set in range 0 -- 65535.
+          },
+        ],
+        &quot;nameServers&quot;: [ # Required. A list of name servers that store the DNS zone for this domain. Each name server is a domain name, with Unicode domain names expressed in Punycode format.
+          &quot;A String&quot;,
+        ],
+      },
+      &quot;glueRecords&quot;: [ # The list of glue records for this `Registration`. Commonly empty.
+        { # Defines a host on your domain that is a DNS name server for your domain and/or other domains. Glue records are a way of making the IP address of a name server known, even when it serves DNS queries for its parent domain. For example, when `ns.example.com` is a name server for `example.com`, the host `ns.example.com` must have a glue record to break the circular DNS reference.
+          &quot;hostName&quot;: &quot;A String&quot;, # Required. Domain name of the host in Punycode format.
+          &quot;ipv4Addresses&quot;: [ # List of IPv4 addresses corresponding to this host in the standard decimal format (e.g. `198.51.100.1`). At least one of `ipv4_address` and `ipv6_address` must be set.
+            &quot;A String&quot;,
+          ],
+          &quot;ipv6Addresses&quot;: [ # List of IPv6 addresses corresponding to this host in the standard hexadecimal format (e.g. `2001:db8::`). At least one of `ipv4_address` and `ipv6_address` must be set.
+            &quot;A String&quot;,
+          ],
+        },
+      ],
+      &quot;googleDomainsDns&quot;: { # Configuration for using the free DNS zone provided by Google Domains as a `Registration`&#x27;s `dns_provider`. You cannot configure the DNS zone itself using the API. To configure the DNS zone, go to [Google Domains](https://domains.google/). # The free DNS zone provided by [Google Domains](https://domains.google/).
+        &quot;dsRecords&quot;: [ # Output only. The list of DS records published for this domain. The list is automatically populated when `ds_state` is `DS_RECORDS_PUBLISHED`, otherwise it remains empty.
+          { # Defines a Delegation Signer (DS) record, which is needed to enable DNSSEC for a domain. It contains a digest (hash) of a DNSKEY record that must be present in the domain&#x27;s DNS zone.
+            &quot;algorithm&quot;: &quot;A String&quot;, # The algorithm used to generate the referenced DNSKEY.
+            &quot;digest&quot;: &quot;A String&quot;, # The digest generated from the referenced DNSKEY.
+            &quot;digestType&quot;: &quot;A String&quot;, # The hash function used to generate the digest of the referenced DNSKEY.
+            &quot;keyTag&quot;: 42, # The key tag of the record. Must be set in range 0 -- 65535.
+          },
+        ],
+        &quot;dsState&quot;: &quot;A String&quot;, # Required. The state of DS records for this domain. Used to enable or disable automatic DNSSEC.
+        &quot;nameServers&quot;: [ # Output only. A list of name servers that store the DNS zone for this domain. Each name server is a domain name, with Unicode domain names expressed in Punycode format. This field is automatically populated with the name servers assigned to the Google Domains DNS zone.
+          &quot;A String&quot;,
+        ],
+      },
+    },
+    &quot;domainName&quot;: &quot;A String&quot;, # Required. Immutable. The domain name. Unicode domain names must be expressed in Punycode format.
+    &quot;expireTime&quot;: &quot;A String&quot;, # Output only. The expiration timestamp of the `Registration`.
+    &quot;issues&quot;: [ # Output only. The set of issues with the `Registration` that require attention.
+      &quot;A String&quot;,
+    ],
+    &quot;labels&quot;: { # Set of labels associated with the `Registration`.
+      &quot;a_key&quot;: &quot;A String&quot;,
+    },
+    &quot;managementSettings&quot;: { # Defines renewal, billing, and transfer settings for a `Registration`. # Settings for management of the `Registration`, including renewal, billing, and transfer. You cannot update these with the `UpdateRegistration` method. To update these settings, use the `ConfigureManagementSettings` method.
+      &quot;renewalMethod&quot;: &quot;A String&quot;, # Output only. The renewal method for this `Registration`.
+      &quot;transferLockState&quot;: &quot;A String&quot;, # Controls whether the domain can be transferred to another registrar.
+    },
+    &quot;name&quot;: &quot;A String&quot;, # Output only. Name of the `Registration` resource, in the format `projects/*/locations/*/registrations/`.
+    &quot;pendingContactSettings&quot;: { # Defines the contact information associated with a `Registration`. [ICANN](https://icann.org/) requires all domain names to have associated contact information. The `registrant_contact` is considered the domain&#x27;s legal owner, and often the other contacts are identical. # Output only. Pending contact settings for the `Registration`. Updates to the `contact_settings` field that change its `registrant_contact` or `privacy` fields require email confirmation by the `registrant_contact` before taking effect. This field is set only if there are pending updates to the `contact_settings` that have not yet been confirmed. To confirm the changes, the `registrant_contact` must follow the instructions in the email they receive.
+      &quot;adminContact&quot;: { # Details required for a contact associated with a `Registration`. # Required. The administrative contact for the `Registration`.
+        &quot;email&quot;: &quot;A String&quot;, # Required. Email address of the contact.
+        &quot;faxNumber&quot;: &quot;A String&quot;, # Fax number of the contact in international format. For example, `&quot;+1-800-555-0123&quot;`.
+        &quot;phoneNumber&quot;: &quot;A String&quot;, # Required. Phone number of the contact in international format. For example, `&quot;+1-800-555-0123&quot;`.
+        &quot;postalAddress&quot;: { # Represents a postal address, e.g. for postal delivery or payments addresses. Given a postal address, a postal service can deliver items to a premise, P.O. Box or similar. It is not intended to model geographical locations (roads, towns, mountains). In typical usage an address would be created via user input or from importing existing data, depending on the type of process. Advice on address input / editing: - Use an i18n-ready address widget such as https://github.com/google/libaddressinput) - Users should not be presented with UI elements for input or editing of fields outside countries where that field is used. For more guidance on how to use this schema, please see: https://support.google.com/business/answer/6397478 # Required. Postal address of the contact.
+          &quot;addressLines&quot;: [ # Unstructured address lines describing the lower levels of an address. Because values in address_lines do not have type information and may sometimes contain multiple values in a single field (e.g. &quot;Austin, TX&quot;), it is important that the line order is clear. The order of address lines should be &quot;envelope order&quot; for the country/region of the address. In places where this can vary (e.g. Japan), address_language is used to make it explicit (e.g. &quot;ja&quot; for large-to-small ordering and &quot;ja-Latn&quot; or &quot;en&quot; for small-to-large). This way, the most specific line of an address can be selected based on the language. The minimum permitted structural representation of an address consists of a region_code with all remaining information placed in the address_lines. It would be possible to format such an address very approximately without geocoding, but no semantic reasoning could be made about any of the address components until it was at least partially resolved. Creating an address only containing a region_code and address_lines, and then geocoding is the recommended way to handle completely unstructured addresses (as opposed to guessing which parts of the address should be localities or administrative areas).
+            &quot;A String&quot;,
+          ],
+          &quot;administrativeArea&quot;: &quot;A String&quot;, # Optional. Highest administrative subdivision which is used for postal addresses of a country or region. For example, this can be a state, a province, an oblast, or a prefecture. Specifically, for Spain this is the province and not the autonomous community (e.g. &quot;Barcelona&quot; and not &quot;Catalonia&quot;). Many countries don&#x27;t use an administrative area in postal addresses. E.g. in Switzerland this should be left unpopulated.
+          &quot;languageCode&quot;: &quot;A String&quot;, # Optional. BCP-47 language code of the contents of this address (if known). This is often the UI language of the input form or is expected to match one of the languages used in the address&#x27; country/region, or their transliterated equivalents. This can affect formatting in certain countries, but is not critical to the correctness of the data and will never affect any validation or other non-formatting related operations. If this value is not known, it should be omitted (rather than specifying a possibly incorrect default). Examples: &quot;zh-Hant&quot;, &quot;ja&quot;, &quot;ja-Latn&quot;, &quot;en&quot;.
+          &quot;locality&quot;: &quot;A String&quot;, # Optional. Generally refers to the city/town portion of the address. Examples: US city, IT comune, UK post town. In regions of the world where localities are not well defined or do not fit into this structure well, leave locality empty and use address_lines.
+          &quot;organization&quot;: &quot;A String&quot;, # Optional. The name of the organization at the address.
+          &quot;postalCode&quot;: &quot;A String&quot;, # Optional. Postal code of the address. Not all countries use or require postal codes to be present, but where they are used, they may trigger additional validation with other parts of the address (e.g. state/zip validation in the U.S.A.).
+          &quot;recipients&quot;: [ # Optional. The recipient at the address. This field may, under certain circumstances, contain multiline information. For example, it might contain &quot;care of&quot; information.
+            &quot;A String&quot;,
+          ],
+          &quot;regionCode&quot;: &quot;A String&quot;, # Required. CLDR region code of the country/region of the address. This is never inferred and it is up to the user to ensure the value is correct. See http://cldr.unicode.org/ and http://www.unicode.org/cldr/charts/30/supplemental/territory_information.html for details. Example: &quot;CH&quot; for Switzerland.
+          &quot;revision&quot;: 42, # The schema revision of the `PostalAddress`. This must be set to 0, which is the latest revision. All new revisions **must** be backward compatible with old revisions.
+          &quot;sortingCode&quot;: &quot;A String&quot;, # Optional. Additional, country-specific, sorting code. This is not used in most regions. Where it is used, the value is either a string like &quot;CEDEX&quot;, optionally followed by a number (e.g. &quot;CEDEX 7&quot;), or just a number alone, representing the &quot;sector code&quot; (Jamaica), &quot;delivery area indicator&quot; (Malawi) or &quot;post office indicator&quot; (e.g. Côte d&#x27;Ivoire).
+          &quot;sublocality&quot;: &quot;A String&quot;, # Optional. Sublocality of the address. For example, this can be neighborhoods, boroughs, districts.
+        },
+      },
+      &quot;privacy&quot;: &quot;A String&quot;, # Required. Privacy setting for the contacts associated with the `Registration`.
+      &quot;registrantContact&quot;: { # Details required for a contact associated with a `Registration`. # Required. The registrant contact for the `Registration`. *Caution: Anyone with access to this email address, phone number, and/or postal address can take control of the domain.* *Warning: For new `Registration`s, the registrant will receive an email confirmation that they must complete within 15 days to avoid domain suspension.*
+        &quot;email&quot;: &quot;A String&quot;, # Required. Email address of the contact.
+        &quot;faxNumber&quot;: &quot;A String&quot;, # Fax number of the contact in international format. For example, `&quot;+1-800-555-0123&quot;`.
+        &quot;phoneNumber&quot;: &quot;A String&quot;, # Required. Phone number of the contact in international format. For example, `&quot;+1-800-555-0123&quot;`.
+        &quot;postalAddress&quot;: { # Represents a postal address, e.g. for postal delivery or payments addresses. Given a postal address, a postal service can deliver items to a premise, P.O. Box or similar. It is not intended to model geographical locations (roads, towns, mountains). In typical usage an address would be created via user input or from importing existing data, depending on the type of process. Advice on address input / editing: - Use an i18n-ready address widget such as https://github.com/google/libaddressinput) - Users should not be presented with UI elements for input or editing of fields outside countries where that field is used. For more guidance on how to use this schema, please see: https://support.google.com/business/answer/6397478 # Required. Postal address of the contact.
+          &quot;addressLines&quot;: [ # Unstructured address lines describing the lower levels of an address. Because values in address_lines do not have type information and may sometimes contain multiple values in a single field (e.g. &quot;Austin, TX&quot;), it is important that the line order is clear. The order of address lines should be &quot;envelope order&quot; for the country/region of the address. In places where this can vary (e.g. Japan), address_language is used to make it explicit (e.g. &quot;ja&quot; for large-to-small ordering and &quot;ja-Latn&quot; or &quot;en&quot; for small-to-large). This way, the most specific line of an address can be selected based on the language. The minimum permitted structural representation of an address consists of a region_code with all remaining information placed in the address_lines. It would be possible to format such an address very approximately without geocoding, but no semantic reasoning could be made about any of the address components until it was at least partially resolved. Creating an address only containing a region_code and address_lines, and then geocoding is the recommended way to handle completely unstructured addresses (as opposed to guessing which parts of the address should be localities or administrative areas).
+            &quot;A String&quot;,
+          ],
+          &quot;administrativeArea&quot;: &quot;A String&quot;, # Optional. Highest administrative subdivision which is used for postal addresses of a country or region. For example, this can be a state, a province, an oblast, or a prefecture. Specifically, for Spain this is the province and not the autonomous community (e.g. &quot;Barcelona&quot; and not &quot;Catalonia&quot;). Many countries don&#x27;t use an administrative area in postal addresses. E.g. in Switzerland this should be left unpopulated.
+          &quot;languageCode&quot;: &quot;A String&quot;, # Optional. BCP-47 language code of the contents of this address (if known). This is often the UI language of the input form or is expected to match one of the languages used in the address&#x27; country/region, or their transliterated equivalents. This can affect formatting in certain countries, but is not critical to the correctness of the data and will never affect any validation or other non-formatting related operations. If this value is not known, it should be omitted (rather than specifying a possibly incorrect default). Examples: &quot;zh-Hant&quot;, &quot;ja&quot;, &quot;ja-Latn&quot;, &quot;en&quot;.
+          &quot;locality&quot;: &quot;A String&quot;, # Optional. Generally refers to the city/town portion of the address. Examples: US city, IT comune, UK post town. In regions of the world where localities are not well defined or do not fit into this structure well, leave locality empty and use address_lines.
+          &quot;organization&quot;: &quot;A String&quot;, # Optional. The name of the organization at the address.
+          &quot;postalCode&quot;: &quot;A String&quot;, # Optional. Postal code of the address. Not all countries use or require postal codes to be present, but where they are used, they may trigger additional validation with other parts of the address (e.g. state/zip validation in the U.S.A.).
+          &quot;recipients&quot;: [ # Optional. The recipient at the address. This field may, under certain circumstances, contain multiline information. For example, it might contain &quot;care of&quot; information.
+            &quot;A String&quot;,
+          ],
+          &quot;regionCode&quot;: &quot;A String&quot;, # Required. CLDR region code of the country/region of the address. This is never inferred and it is up to the user to ensure the value is correct. See http://cldr.unicode.org/ and http://www.unicode.org/cldr/charts/30/supplemental/territory_information.html for details. Example: &quot;CH&quot; for Switzerland.
+          &quot;revision&quot;: 42, # The schema revision of the `PostalAddress`. This must be set to 0, which is the latest revision. All new revisions **must** be backward compatible with old revisions.
+          &quot;sortingCode&quot;: &quot;A String&quot;, # Optional. Additional, country-specific, sorting code. This is not used in most regions. Where it is used, the value is either a string like &quot;CEDEX&quot;, optionally followed by a number (e.g. &quot;CEDEX 7&quot;), or just a number alone, representing the &quot;sector code&quot; (Jamaica), &quot;delivery area indicator&quot; (Malawi) or &quot;post office indicator&quot; (e.g. Côte d&#x27;Ivoire).
+          &quot;sublocality&quot;: &quot;A String&quot;, # Optional. Sublocality of the address. For example, this can be neighborhoods, boroughs, districts.
+        },
+      },
+      &quot;technicalContact&quot;: { # Details required for a contact associated with a `Registration`. # Required. The technical contact for the `Registration`.
+        &quot;email&quot;: &quot;A String&quot;, # Required. Email address of the contact.
+        &quot;faxNumber&quot;: &quot;A String&quot;, # Fax number of the contact in international format. For example, `&quot;+1-800-555-0123&quot;`.
+        &quot;phoneNumber&quot;: &quot;A String&quot;, # Required. Phone number of the contact in international format. For example, `&quot;+1-800-555-0123&quot;`.
+        &quot;postalAddress&quot;: { # Represents a postal address, e.g. for postal delivery or payments addresses. Given a postal address, a postal service can deliver items to a premise, P.O. Box or similar. It is not intended to model geographical locations (roads, towns, mountains). In typical usage an address would be created via user input or from importing existing data, depending on the type of process. Advice on address input / editing: - Use an i18n-ready address widget such as https://github.com/google/libaddressinput) - Users should not be presented with UI elements for input or editing of fields outside countries where that field is used. For more guidance on how to use this schema, please see: https://support.google.com/business/answer/6397478 # Required. Postal address of the contact.
+          &quot;addressLines&quot;: [ # Unstructured address lines describing the lower levels of an address. Because values in address_lines do not have type information and may sometimes contain multiple values in a single field (e.g. &quot;Austin, TX&quot;), it is important that the line order is clear. The order of address lines should be &quot;envelope order&quot; for the country/region of the address. In places where this can vary (e.g. Japan), address_language is used to make it explicit (e.g. &quot;ja&quot; for large-to-small ordering and &quot;ja-Latn&quot; or &quot;en&quot; for small-to-large). This way, the most specific line of an address can be selected based on the language. The minimum permitted structural representation of an address consists of a region_code with all remaining information placed in the address_lines. It would be possible to format such an address very approximately without geocoding, but no semantic reasoning could be made about any of the address components until it was at least partially resolved. Creating an address only containing a region_code and address_lines, and then geocoding is the recommended way to handle completely unstructured addresses (as opposed to guessing which parts of the address should be localities or administrative areas).
+            &quot;A String&quot;,
+          ],
+          &quot;administrativeArea&quot;: &quot;A String&quot;, # Optional. Highest administrative subdivision which is used for postal addresses of a country or region. For example, this can be a state, a province, an oblast, or a prefecture. Specifically, for Spain this is the province and not the autonomous community (e.g. &quot;Barcelona&quot; and not &quot;Catalonia&quot;). Many countries don&#x27;t use an administrative area in postal addresses. E.g. in Switzerland this should be left unpopulated.
+          &quot;languageCode&quot;: &quot;A String&quot;, # Optional. BCP-47 language code of the contents of this address (if known). This is often the UI language of the input form or is expected to match one of the languages used in the address&#x27; country/region, or their transliterated equivalents. This can affect formatting in certain countries, but is not critical to the correctness of the data and will never affect any validation or other non-formatting related operations. If this value is not known, it should be omitted (rather than specifying a possibly incorrect default). Examples: &quot;zh-Hant&quot;, &quot;ja&quot;, &quot;ja-Latn&quot;, &quot;en&quot;.
+          &quot;locality&quot;: &quot;A String&quot;, # Optional. Generally refers to the city/town portion of the address. Examples: US city, IT comune, UK post town. In regions of the world where localities are not well defined or do not fit into this structure well, leave locality empty and use address_lines.
+          &quot;organization&quot;: &quot;A String&quot;, # Optional. The name of the organization at the address.
+          &quot;postalCode&quot;: &quot;A String&quot;, # Optional. Postal code of the address. Not all countries use or require postal codes to be present, but where they are used, they may trigger additional validation with other parts of the address (e.g. state/zip validation in the U.S.A.).
+          &quot;recipients&quot;: [ # Optional. The recipient at the address. This field may, under certain circumstances, contain multiline information. For example, it might contain &quot;care of&quot; information.
+            &quot;A String&quot;,
+          ],
+          &quot;regionCode&quot;: &quot;A String&quot;, # Required. CLDR region code of the country/region of the address. This is never inferred and it is up to the user to ensure the value is correct. See http://cldr.unicode.org/ and http://www.unicode.org/cldr/charts/30/supplemental/territory_information.html for details. Example: &quot;CH&quot; for Switzerland.
+          &quot;revision&quot;: 42, # The schema revision of the `PostalAddress`. This must be set to 0, which is the latest revision. All new revisions **must** be backward compatible with old revisions.
+          &quot;sortingCode&quot;: &quot;A String&quot;, # Optional. Additional, country-specific, sorting code. This is not used in most regions. Where it is used, the value is either a string like &quot;CEDEX&quot;, optionally followed by a number (e.g. &quot;CEDEX 7&quot;), or just a number alone, representing the &quot;sector code&quot; (Jamaica), &quot;delivery area indicator&quot; (Malawi) or &quot;post office indicator&quot; (e.g. Côte d&#x27;Ivoire).
+          &quot;sublocality&quot;: &quot;A String&quot;, # Optional. Sublocality of the address. For example, this can be neighborhoods, boroughs, districts.
+        },
+      },
+    },
+    &quot;state&quot;: &quot;A String&quot;, # Output only. The state of the `Registration`
+    &quot;supportedPrivacy&quot;: [ # Output only. Set of options for the `contact_settings.privacy` field that this `Registration` supports.
+      &quot;A String&quot;,
+    ],
+  },
+  &quot;validateOnly&quot;: True or False, # Validate the request without actually transferring the domain.
+  &quot;yearlyPrice&quot;: { # Represents an amount of money with its currency type. # Required. Acknowledgement of the price to transfer or renew the domain for one year. Call `RetrieveTransferParameters` to obtain the price, which you must acknowledge.
+    &quot;currencyCode&quot;: &quot;A String&quot;, # The three-letter currency code defined in ISO 4217.
+    &quot;nanos&quot;: 42, # Number of nano (10^-9) units of the amount. The value must be between -999,999,999 and +999,999,999 inclusive. If `units` is positive, `nanos` must be positive or zero. If `units` is zero, `nanos` can be positive, zero, or negative. If `units` is negative, `nanos` must be negative or zero. For example $-1.75 is represented as `units`=-1 and `nanos`=-750,000,000.
+    &quot;units&quot;: &quot;A String&quot;, # The whole units of the amount. For example if `currencyCode` is `&quot;USD&quot;`, then 1 unit is one US dollar.
+  },
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # This resource represents a long-running operation that is the result of a network API call.
+  &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+  &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+    &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+      {
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    ],
+    &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+  },
+  &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+  &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+}</pre>
+</div>
+
 </body></html>
\ No newline at end of file
diff --git a/docs/dyn/firebaseappcheck_v1beta.projects.services.html b/docs/dyn/firebaseappcheck_v1beta.projects.services.html
index dfd4578..9e82b6e 100644
--- a/docs/dyn/firebaseappcheck_v1beta.projects.services.html
+++ b/docs/dyn/firebaseappcheck_v1beta.projects.services.html
@@ -105,9 +105,9 @@
 { # Request message for the BatchUpdateServices method.
   &quot;requests&quot;: [ # Required. The request messages specifying the Services to update. A maximum of 100 objects can be updated in a batch.
     { # Request message for the UpdateService method as well as an individual update message for the BatchUpdateServices method.
-      &quot;service&quot;: { # The enforcement configuration for a Firebase service supported by App Check. # Required. The Service to update. The Service&#x27;s `name` field is used to identify the Service to be updated, in the format: ``` projects/{project_number}/services/{service_id} ``` Note that the `service_id` element must be a supported service ID. Currently, the following service IDs are supported: * `firebasestorage.googleapis.com` (Cloud Storage for Firebase) * `firebasedatabase.googleapis.com` (Firebase Realtime Database)
+      &quot;service&quot;: { # The enforcement configuration for a Firebase service supported by App Check. # Required. The Service to update. The Service&#x27;s `name` field is used to identify the Service to be updated, in the format: ``` projects/{project_number}/services/{service_id} ``` Note that the `service_id` element must be a supported service ID. Currently, the following service IDs are supported: * `firebasestorage.googleapis.com` (Cloud Storage for Firebase) * `firebasedatabase.googleapis.com` (Firebase Realtime Database) * `firestore.googleapis.com` (Cloud Firestore)
         &quot;enforcementMode&quot;: &quot;A String&quot;, # Required. The App Check enforcement mode for this service.
-        &quot;name&quot;: &quot;A String&quot;, # Required. The relative resource name of the service configuration object, in the format: ``` projects/{project_number}/services/{service_id} ``` Note that the `service_id` element must be a supported service ID. Currently, the following service IDs are supported: * `firebasestorage.googleapis.com` (Cloud Storage for Firebase) * `firebasedatabase.googleapis.com` (Firebase Realtime Database)
+        &quot;name&quot;: &quot;A String&quot;, # Required. The relative resource name of the service configuration object, in the format: ``` projects/{project_number}/services/{service_id} ``` Note that the `service_id` element must be a supported service ID. Currently, the following service IDs are supported: * `firebasestorage.googleapis.com` (Cloud Storage for Firebase) * `firebasedatabase.googleapis.com` (Firebase Realtime Database) * `firestore.googleapis.com` (Cloud Firestore)
       },
       &quot;updateMask&quot;: &quot;A String&quot;, # Required. A comma-separated list of names of fields in the Service to update. Example: `enforcement_mode`.
     },
@@ -127,7 +127,7 @@
   &quot;services&quot;: [ # Service objects after the updates have been applied.
     { # The enforcement configuration for a Firebase service supported by App Check.
       &quot;enforcementMode&quot;: &quot;A String&quot;, # Required. The App Check enforcement mode for this service.
-      &quot;name&quot;: &quot;A String&quot;, # Required. The relative resource name of the service configuration object, in the format: ``` projects/{project_number}/services/{service_id} ``` Note that the `service_id` element must be a supported service ID. Currently, the following service IDs are supported: * `firebasestorage.googleapis.com` (Cloud Storage for Firebase) * `firebasedatabase.googleapis.com` (Firebase Realtime Database)
+      &quot;name&quot;: &quot;A String&quot;, # Required. The relative resource name of the service configuration object, in the format: ``` projects/{project_number}/services/{service_id} ``` Note that the `service_id` element must be a supported service ID. Currently, the following service IDs are supported: * `firebasestorage.googleapis.com` (Cloud Storage for Firebase) * `firebasedatabase.googleapis.com` (Firebase Realtime Database) * `firestore.googleapis.com` (Cloud Firestore)
     },
   ],
 }</pre>
@@ -143,7 +143,7 @@
   <pre>Gets the Service configuration for the specified service name.
 
 Args:
-  name: string, Required. The relative resource name of the Service to retrieve, in the format: ``` projects/{project_number}/services/{service_id} ``` Note that the `service_id` element must be a supported service ID. Currently, the following service IDs are supported: * `firebasestorage.googleapis.com` (Cloud Storage for Firebase) * `firebasedatabase.googleapis.com` (Firebase Realtime Database) (required)
+  name: string, Required. The relative resource name of the Service to retrieve, in the format: ``` projects/{project_number}/services/{service_id} ``` Note that the `service_id` element must be a supported service ID. Currently, the following service IDs are supported: * `firebasestorage.googleapis.com` (Cloud Storage for Firebase) * `firebasedatabase.googleapis.com` (Firebase Realtime Database) * `firestore.googleapis.com` (Cloud Firestore) (required)
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format
@@ -154,7 +154,7 @@
 
     { # The enforcement configuration for a Firebase service supported by App Check.
   &quot;enforcementMode&quot;: &quot;A String&quot;, # Required. The App Check enforcement mode for this service.
-  &quot;name&quot;: &quot;A String&quot;, # Required. The relative resource name of the service configuration object, in the format: ``` projects/{project_number}/services/{service_id} ``` Note that the `service_id` element must be a supported service ID. Currently, the following service IDs are supported: * `firebasestorage.googleapis.com` (Cloud Storage for Firebase) * `firebasedatabase.googleapis.com` (Firebase Realtime Database)
+  &quot;name&quot;: &quot;A String&quot;, # Required. The relative resource name of the service configuration object, in the format: ``` projects/{project_number}/services/{service_id} ``` Note that the `service_id` element must be a supported service ID. Currently, the following service IDs are supported: * `firebasestorage.googleapis.com` (Cloud Storage for Firebase) * `firebasedatabase.googleapis.com` (Firebase Realtime Database) * `firestore.googleapis.com` (Cloud Firestore)
 }</pre>
 </div>
 
@@ -179,7 +179,7 @@
   &quot;services&quot;: [ # The Services retrieved.
     { # The enforcement configuration for a Firebase service supported by App Check.
       &quot;enforcementMode&quot;: &quot;A String&quot;, # Required. The App Check enforcement mode for this service.
-      &quot;name&quot;: &quot;A String&quot;, # Required. The relative resource name of the service configuration object, in the format: ``` projects/{project_number}/services/{service_id} ``` Note that the `service_id` element must be a supported service ID. Currently, the following service IDs are supported: * `firebasestorage.googleapis.com` (Cloud Storage for Firebase) * `firebasedatabase.googleapis.com` (Firebase Realtime Database)
+      &quot;name&quot;: &quot;A String&quot;, # Required. The relative resource name of the service configuration object, in the format: ``` projects/{project_number}/services/{service_id} ``` Note that the `service_id` element must be a supported service ID. Currently, the following service IDs are supported: * `firebasestorage.googleapis.com` (Cloud Storage for Firebase) * `firebasedatabase.googleapis.com` (Firebase Realtime Database) * `firestore.googleapis.com` (Cloud Firestore)
     },
   ],
 }</pre>
@@ -204,13 +204,13 @@
   <pre>Updates the specified Service configuration.
 
 Args:
-  name: string, Required. The relative resource name of the service configuration object, in the format: ``` projects/{project_number}/services/{service_id} ``` Note that the `service_id` element must be a supported service ID. Currently, the following service IDs are supported: * `firebasestorage.googleapis.com` (Cloud Storage for Firebase) * `firebasedatabase.googleapis.com` (Firebase Realtime Database) (required)
+  name: string, Required. The relative resource name of the service configuration object, in the format: ``` projects/{project_number}/services/{service_id} ``` Note that the `service_id` element must be a supported service ID. Currently, the following service IDs are supported: * `firebasestorage.googleapis.com` (Cloud Storage for Firebase) * `firebasedatabase.googleapis.com` (Firebase Realtime Database) * `firestore.googleapis.com` (Cloud Firestore) (required)
   body: object, The request body.
     The object takes the form of:
 
 { # The enforcement configuration for a Firebase service supported by App Check.
   &quot;enforcementMode&quot;: &quot;A String&quot;, # Required. The App Check enforcement mode for this service.
-  &quot;name&quot;: &quot;A String&quot;, # Required. The relative resource name of the service configuration object, in the format: ``` projects/{project_number}/services/{service_id} ``` Note that the `service_id` element must be a supported service ID. Currently, the following service IDs are supported: * `firebasestorage.googleapis.com` (Cloud Storage for Firebase) * `firebasedatabase.googleapis.com` (Firebase Realtime Database)
+  &quot;name&quot;: &quot;A String&quot;, # Required. The relative resource name of the service configuration object, in the format: ``` projects/{project_number}/services/{service_id} ``` Note that the `service_id` element must be a supported service ID. Currently, the following service IDs are supported: * `firebasestorage.googleapis.com` (Cloud Storage for Firebase) * `firebasedatabase.googleapis.com` (Firebase Realtime Database) * `firestore.googleapis.com` (Cloud Firestore)
 }
 
   updateMask: string, Required. A comma-separated list of names of fields in the Service to update. Example: `enforcement_mode`.
@@ -224,7 +224,7 @@
 
     { # The enforcement configuration for a Firebase service supported by App Check.
   &quot;enforcementMode&quot;: &quot;A String&quot;, # Required. The App Check enforcement mode for this service.
-  &quot;name&quot;: &quot;A String&quot;, # Required. The relative resource name of the service configuration object, in the format: ``` projects/{project_number}/services/{service_id} ``` Note that the `service_id` element must be a supported service ID. Currently, the following service IDs are supported: * `firebasestorage.googleapis.com` (Cloud Storage for Firebase) * `firebasedatabase.googleapis.com` (Firebase Realtime Database)
+  &quot;name&quot;: &quot;A String&quot;, # Required. The relative resource name of the service configuration object, in the format: ``` projects/{project_number}/services/{service_id} ``` Note that the `service_id` element must be a supported service ID. Currently, the following service IDs are supported: * `firebasestorage.googleapis.com` (Cloud Storage for Firebase) * `firebasedatabase.googleapis.com` (Firebase Realtime Database) * `firestore.googleapis.com` (Cloud Firestore)
 }</pre>
 </div>
 
diff --git a/docs/dyn/firestore_v1.projects.databases.html b/docs/dyn/firestore_v1.projects.databases.html
index 3ee210e..a0bc5ad 100644
--- a/docs/dyn/firestore_v1.projects.databases.html
+++ b/docs/dyn/firestore_v1.projects.databases.html
@@ -172,7 +172,7 @@
 Returns:
   An object of the form:
 
-    { # A Cloud Firestore Database in Native Mode. Currently one database is allowed per cloud project. It is named &#x27;(default)&#x27;
+    { # A Cloud Firestore Database. Currently only one database is allowed per cloud project; this database must have a `database_id` of &#x27;(default)&#x27;.
   &quot;concurrencyMode&quot;: &quot;A String&quot;, # The concurrency control mode to use for this database.
   &quot;etag&quot;: &quot;A String&quot;, # This checksum is computed by the server based on the value of other fields, and may be sent on update and delete requests to ensure the client has an up-to-date value before proceeding.
   &quot;locationId&quot;: &quot;A String&quot;, # The location of the database. Available databases are listed at https://cloud.google.com/firestore/docs/locations.
@@ -242,7 +242,7 @@
 
     { # The list of databases for a project.
   &quot;databases&quot;: [ # The databases in the project.
-    { # A Cloud Firestore Database in Native Mode. Currently one database is allowed per cloud project. It is named &#x27;(default)&#x27;
+    { # A Cloud Firestore Database. Currently only one database is allowed per cloud project; this database must have a `database_id` of &#x27;(default)&#x27;.
       &quot;concurrencyMode&quot;: &quot;A String&quot;, # The concurrency control mode to use for this database.
       &quot;etag&quot;: &quot;A String&quot;, # This checksum is computed by the server based on the value of other fields, and may be sent on update and delete requests to ensure the client has an up-to-date value before proceeding.
       &quot;locationId&quot;: &quot;A String&quot;, # The location of the database. Available databases are listed at https://cloud.google.com/firestore/docs/locations.
@@ -262,7 +262,7 @@
   body: object, The request body.
     The object takes the form of:
 
-{ # A Cloud Firestore Database in Native Mode. Currently one database is allowed per cloud project. It is named &#x27;(default)&#x27;
+{ # A Cloud Firestore Database. Currently only one database is allowed per cloud project; this database must have a `database_id` of &#x27;(default)&#x27;.
   &quot;concurrencyMode&quot;: &quot;A String&quot;, # The concurrency control mode to use for this database.
   &quot;etag&quot;: &quot;A String&quot;, # This checksum is computed by the server based on the value of other fields, and may be sent on update and delete requests to ensure the client has an up-to-date value before proceeding.
   &quot;locationId&quot;: &quot;A String&quot;, # The location of the database. Available databases are listed at https://cloud.google.com/firestore/docs/locations.
diff --git a/docs/dyn/firestore_v1beta1.projects.databases.documents.html b/docs/dyn/firestore_v1beta1.projects.databases.documents.html
index 712832b..352fb52 100644
--- a/docs/dyn/firestore_v1beta1.projects.databases.documents.html
+++ b/docs/dyn/firestore_v1beta1.projects.databases.documents.html
@@ -175,7 +175,11 @@
     &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
     &quot;fields&quot;: { # The document&#x27;s fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `&quot;foo&quot; : { map_value: { &quot;x&amp;y&quot; : { string_value: &quot;hello&quot; }}}` would be represented by the field path `foo.x&amp;y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&amp;y` `` represents `x&amp;y` and `` `bak\`tik` `` represents `` bak`tik ``.
       &quot;a_key&quot;: { # A message that can hold any of the supported value types.
-        &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+        &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          &quot;values&quot;: [ # Values in the array.
+            # Object with schema name: Value
+          ],
+        },
         &quot;booleanValue&quot;: True or False, # A boolean value.
         &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
         &quot;doubleValue&quot;: 3.14, # A double value.
@@ -230,31 +234,16 @@
           { # A transformation of a field of the document.
             &quot;appendMissingElements&quot;: { # An array value. # Append the given elements in order if they are not already present in the current field value. If the field is not an array, or if the field does not yet exist, it is first set to the empty array. Equivalent numbers of different types (e.g. 3L and 3.0) are considered equal when checking if a value is missing. NaN is equal to NaN, and Null is equal to Null. If the input contains multiple equivalent values, only the first will be considered. The corresponding transform_result will be the null value.
               &quot;values&quot;: [ # Values in the array.
-                { # A message that can hold any of the supported value types.
-                  &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                  &quot;booleanValue&quot;: True or False, # A boolean value.
-                  &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                  &quot;doubleValue&quot;: 3.14, # A double value.
-                  &quot;geoPointValue&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                    &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                    &quot;longitude&quot;: 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                  },
-                  &quot;integerValue&quot;: &quot;A String&quot;, # An integer value.
-                  &quot;mapValue&quot;: { # A map value. # A map value.
-                    &quot;fields&quot;: { # The map&#x27;s fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                      &quot;a_key&quot;: # Object with schema name: Value
-                    },
-                  },
-                  &quot;nullValue&quot;: &quot;A String&quot;, # A null value.
-                  &quot;referenceValue&quot;: &quot;A String&quot;, # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                  &quot;stringValue&quot;: &quot;A String&quot;, # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                  &quot;timestampValue&quot;: &quot;A String&quot;, # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-                },
+                # Object with schema name: Value
               ],
             },
             &quot;fieldPath&quot;: &quot;A String&quot;, # The path of the field. See Document.fields for the field path syntax reference.
             &quot;increment&quot;: { # A message that can hold any of the supported value types. # Adds the given value to the field&#x27;s current value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If either of the given value or the current field value are doubles, both values will be interpreted as doubles. Double arithmetic and representation of double values follow IEEE 754 semantics. If there is positive/negative integer overflow, the field is resolved to the largest magnitude positive/negative integer.
-              &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                &quot;values&quot;: [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               &quot;booleanValue&quot;: True or False, # A boolean value.
               &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               &quot;doubleValue&quot;: 3.14, # A double value.
@@ -274,7 +263,11 @@
               &quot;timestampValue&quot;: &quot;A String&quot;, # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
             },
             &quot;maximum&quot;: { # A message that can hold any of the supported value types. # Sets the field to the maximum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If a maximum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the larger operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The maximum of a zero stored value and zero input value is always the stored value. The maximum of any numeric value x and NaN is NaN.
-              &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                &quot;values&quot;: [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               &quot;booleanValue&quot;: True or False, # A boolean value.
               &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               &quot;doubleValue&quot;: 3.14, # A double value.
@@ -294,7 +287,11 @@
               &quot;timestampValue&quot;: &quot;A String&quot;, # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
             },
             &quot;minimum&quot;: { # A message that can hold any of the supported value types. # Sets the field to the minimum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the input value. If a minimum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the smaller operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The minimum of a zero stored value and zero input value is always the stored value. The minimum of any numeric value x and NaN is NaN.
-              &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                &quot;values&quot;: [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               &quot;booleanValue&quot;: True or False, # A boolean value.
               &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               &quot;doubleValue&quot;: 3.14, # A double value.
@@ -315,26 +312,7 @@
             },
             &quot;removeAllFromArray&quot;: { # An array value. # Remove all of the given elements from the array in the field. If the field is not an array, or if the field does not yet exist, it is set to the empty array. Equivalent numbers of the different types (e.g. 3L and 3.0) are considered equal when deciding whether an element should be removed. NaN is equal to NaN, and Null is equal to Null. This will remove all equivalent values if there are duplicates. The corresponding transform_result will be the null value.
               &quot;values&quot;: [ # Values in the array.
-                { # A message that can hold any of the supported value types.
-                  &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                  &quot;booleanValue&quot;: True or False, # A boolean value.
-                  &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                  &quot;doubleValue&quot;: 3.14, # A double value.
-                  &quot;geoPointValue&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                    &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                    &quot;longitude&quot;: 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                  },
-                  &quot;integerValue&quot;: &quot;A String&quot;, # An integer value.
-                  &quot;mapValue&quot;: { # A map value. # A map value.
-                    &quot;fields&quot;: { # The map&#x27;s fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                      &quot;a_key&quot;: # Object with schema name: Value
-                    },
-                  },
-                  &quot;nullValue&quot;: &quot;A String&quot;, # A null value.
-                  &quot;referenceValue&quot;: &quot;A String&quot;, # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                  &quot;stringValue&quot;: &quot;A String&quot;, # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                  &quot;timestampValue&quot;: &quot;A String&quot;, # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-                },
+                # Object with schema name: Value
               ],
             },
             &quot;setToServerValue&quot;: &quot;A String&quot;, # Sets the field to the given server value.
@@ -345,7 +323,11 @@
         &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
         &quot;fields&quot;: { # The document&#x27;s fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `&quot;foo&quot; : { map_value: { &quot;x&amp;y&quot; : { string_value: &quot;hello&quot; }}}` would be represented by the field path `foo.x&amp;y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&amp;y` `` represents `x&amp;y` and `` `bak\`tik` `` represents `` bak`tik ``.
           &quot;a_key&quot;: { # A message that can hold any of the supported value types.
-            &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              &quot;values&quot;: [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             &quot;booleanValue&quot;: True or False, # A boolean value.
             &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             &quot;doubleValue&quot;: 3.14, # A double value.
@@ -377,31 +359,16 @@
         { # A transformation of a field of the document.
           &quot;appendMissingElements&quot;: { # An array value. # Append the given elements in order if they are not already present in the current field value. If the field is not an array, or if the field does not yet exist, it is first set to the empty array. Equivalent numbers of different types (e.g. 3L and 3.0) are considered equal when checking if a value is missing. NaN is equal to NaN, and Null is equal to Null. If the input contains multiple equivalent values, only the first will be considered. The corresponding transform_result will be the null value.
             &quot;values&quot;: [ # Values in the array.
-              { # A message that can hold any of the supported value types.
-                &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                &quot;booleanValue&quot;: True or False, # A boolean value.
-                &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                &quot;doubleValue&quot;: 3.14, # A double value.
-                &quot;geoPointValue&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                  &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                  &quot;longitude&quot;: 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                },
-                &quot;integerValue&quot;: &quot;A String&quot;, # An integer value.
-                &quot;mapValue&quot;: { # A map value. # A map value.
-                  &quot;fields&quot;: { # The map&#x27;s fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                    &quot;a_key&quot;: # Object with schema name: Value
-                  },
-                },
-                &quot;nullValue&quot;: &quot;A String&quot;, # A null value.
-                &quot;referenceValue&quot;: &quot;A String&quot;, # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                &quot;stringValue&quot;: &quot;A String&quot;, # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                &quot;timestampValue&quot;: &quot;A String&quot;, # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-              },
+              # Object with schema name: Value
             ],
           },
           &quot;fieldPath&quot;: &quot;A String&quot;, # The path of the field. See Document.fields for the field path syntax reference.
           &quot;increment&quot;: { # A message that can hold any of the supported value types. # Adds the given value to the field&#x27;s current value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If either of the given value or the current field value are doubles, both values will be interpreted as doubles. Double arithmetic and representation of double values follow IEEE 754 semantics. If there is positive/negative integer overflow, the field is resolved to the largest magnitude positive/negative integer.
-            &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              &quot;values&quot;: [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             &quot;booleanValue&quot;: True or False, # A boolean value.
             &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             &quot;doubleValue&quot;: 3.14, # A double value.
@@ -421,7 +388,11 @@
             &quot;timestampValue&quot;: &quot;A String&quot;, # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
           },
           &quot;maximum&quot;: { # A message that can hold any of the supported value types. # Sets the field to the maximum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If a maximum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the larger operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The maximum of a zero stored value and zero input value is always the stored value. The maximum of any numeric value x and NaN is NaN.
-            &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              &quot;values&quot;: [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             &quot;booleanValue&quot;: True or False, # A boolean value.
             &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             &quot;doubleValue&quot;: 3.14, # A double value.
@@ -441,7 +412,11 @@
             &quot;timestampValue&quot;: &quot;A String&quot;, # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
           },
           &quot;minimum&quot;: { # A message that can hold any of the supported value types. # Sets the field to the minimum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the input value. If a minimum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the smaller operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The minimum of a zero stored value and zero input value is always the stored value. The minimum of any numeric value x and NaN is NaN.
-            &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              &quot;values&quot;: [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             &quot;booleanValue&quot;: True or False, # A boolean value.
             &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             &quot;doubleValue&quot;: 3.14, # A double value.
@@ -462,26 +437,7 @@
           },
           &quot;removeAllFromArray&quot;: { # An array value. # Remove all of the given elements from the array in the field. If the field is not an array, or if the field does not yet exist, it is set to the empty array. Equivalent numbers of the different types (e.g. 3L and 3.0) are considered equal when deciding whether an element should be removed. NaN is equal to NaN, and Null is equal to Null. This will remove all equivalent values if there are duplicates. The corresponding transform_result will be the null value.
             &quot;values&quot;: [ # Values in the array.
-              { # A message that can hold any of the supported value types.
-                &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                &quot;booleanValue&quot;: True or False, # A boolean value.
-                &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                &quot;doubleValue&quot;: 3.14, # A double value.
-                &quot;geoPointValue&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                  &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                  &quot;longitude&quot;: 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                },
-                &quot;integerValue&quot;: &quot;A String&quot;, # An integer value.
-                &quot;mapValue&quot;: { # A map value. # A map value.
-                  &quot;fields&quot;: { # The map&#x27;s fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                    &quot;a_key&quot;: # Object with schema name: Value
-                  },
-                },
-                &quot;nullValue&quot;: &quot;A String&quot;, # A null value.
-                &quot;referenceValue&quot;: &quot;A String&quot;, # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                &quot;stringValue&quot;: &quot;A String&quot;, # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                &quot;timestampValue&quot;: &quot;A String&quot;, # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-              },
+              # Object with schema name: Value
             ],
           },
           &quot;setToServerValue&quot;: &quot;A String&quot;, # Sets the field to the given server value.
@@ -515,7 +471,11 @@
     { # The result of applying a write.
       &quot;transformResults&quot;: [ # The results of applying each DocumentTransform.FieldTransform, in the same order.
         { # A message that can hold any of the supported value types.
-          &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            &quot;values&quot;: [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           &quot;booleanValue&quot;: True or False, # A boolean value.
           &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           &quot;doubleValue&quot;: 3.14, # A double value.
@@ -603,31 +563,16 @@
           { # A transformation of a field of the document.
             &quot;appendMissingElements&quot;: { # An array value. # Append the given elements in order if they are not already present in the current field value. If the field is not an array, or if the field does not yet exist, it is first set to the empty array. Equivalent numbers of different types (e.g. 3L and 3.0) are considered equal when checking if a value is missing. NaN is equal to NaN, and Null is equal to Null. If the input contains multiple equivalent values, only the first will be considered. The corresponding transform_result will be the null value.
               &quot;values&quot;: [ # Values in the array.
-                { # A message that can hold any of the supported value types.
-                  &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                  &quot;booleanValue&quot;: True or False, # A boolean value.
-                  &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                  &quot;doubleValue&quot;: 3.14, # A double value.
-                  &quot;geoPointValue&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                    &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                    &quot;longitude&quot;: 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                  },
-                  &quot;integerValue&quot;: &quot;A String&quot;, # An integer value.
-                  &quot;mapValue&quot;: { # A map value. # A map value.
-                    &quot;fields&quot;: { # The map&#x27;s fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                      &quot;a_key&quot;: # Object with schema name: Value
-                    },
-                  },
-                  &quot;nullValue&quot;: &quot;A String&quot;, # A null value.
-                  &quot;referenceValue&quot;: &quot;A String&quot;, # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                  &quot;stringValue&quot;: &quot;A String&quot;, # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                  &quot;timestampValue&quot;: &quot;A String&quot;, # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-                },
+                # Object with schema name: Value
               ],
             },
             &quot;fieldPath&quot;: &quot;A String&quot;, # The path of the field. See Document.fields for the field path syntax reference.
             &quot;increment&quot;: { # A message that can hold any of the supported value types. # Adds the given value to the field&#x27;s current value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If either of the given value or the current field value are doubles, both values will be interpreted as doubles. Double arithmetic and representation of double values follow IEEE 754 semantics. If there is positive/negative integer overflow, the field is resolved to the largest magnitude positive/negative integer.
-              &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                &quot;values&quot;: [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               &quot;booleanValue&quot;: True or False, # A boolean value.
               &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               &quot;doubleValue&quot;: 3.14, # A double value.
@@ -647,7 +592,11 @@
               &quot;timestampValue&quot;: &quot;A String&quot;, # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
             },
             &quot;maximum&quot;: { # A message that can hold any of the supported value types. # Sets the field to the maximum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If a maximum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the larger operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The maximum of a zero stored value and zero input value is always the stored value. The maximum of any numeric value x and NaN is NaN.
-              &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                &quot;values&quot;: [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               &quot;booleanValue&quot;: True or False, # A boolean value.
               &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               &quot;doubleValue&quot;: 3.14, # A double value.
@@ -667,7 +616,11 @@
               &quot;timestampValue&quot;: &quot;A String&quot;, # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
             },
             &quot;minimum&quot;: { # A message that can hold any of the supported value types. # Sets the field to the minimum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the input value. If a minimum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the smaller operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The minimum of a zero stored value and zero input value is always the stored value. The minimum of any numeric value x and NaN is NaN.
-              &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                &quot;values&quot;: [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               &quot;booleanValue&quot;: True or False, # A boolean value.
               &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               &quot;doubleValue&quot;: 3.14, # A double value.
@@ -688,26 +641,7 @@
             },
             &quot;removeAllFromArray&quot;: { # An array value. # Remove all of the given elements from the array in the field. If the field is not an array, or if the field does not yet exist, it is set to the empty array. Equivalent numbers of the different types (e.g. 3L and 3.0) are considered equal when deciding whether an element should be removed. NaN is equal to NaN, and Null is equal to Null. This will remove all equivalent values if there are duplicates. The corresponding transform_result will be the null value.
               &quot;values&quot;: [ # Values in the array.
-                { # A message that can hold any of the supported value types.
-                  &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                  &quot;booleanValue&quot;: True or False, # A boolean value.
-                  &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                  &quot;doubleValue&quot;: 3.14, # A double value.
-                  &quot;geoPointValue&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                    &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                    &quot;longitude&quot;: 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                  },
-                  &quot;integerValue&quot;: &quot;A String&quot;, # An integer value.
-                  &quot;mapValue&quot;: { # A map value. # A map value.
-                    &quot;fields&quot;: { # The map&#x27;s fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                      &quot;a_key&quot;: # Object with schema name: Value
-                    },
-                  },
-                  &quot;nullValue&quot;: &quot;A String&quot;, # A null value.
-                  &quot;referenceValue&quot;: &quot;A String&quot;, # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                  &quot;stringValue&quot;: &quot;A String&quot;, # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                  &quot;timestampValue&quot;: &quot;A String&quot;, # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-                },
+                # Object with schema name: Value
               ],
             },
             &quot;setToServerValue&quot;: &quot;A String&quot;, # Sets the field to the given server value.
@@ -718,7 +652,11 @@
         &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
         &quot;fields&quot;: { # The document&#x27;s fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `&quot;foo&quot; : { map_value: { &quot;x&amp;y&quot; : { string_value: &quot;hello&quot; }}}` would be represented by the field path `foo.x&amp;y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&amp;y` `` represents `x&amp;y` and `` `bak\`tik` `` represents `` bak`tik ``.
           &quot;a_key&quot;: { # A message that can hold any of the supported value types.
-            &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              &quot;values&quot;: [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             &quot;booleanValue&quot;: True or False, # A boolean value.
             &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             &quot;doubleValue&quot;: 3.14, # A double value.
@@ -750,31 +688,16 @@
         { # A transformation of a field of the document.
           &quot;appendMissingElements&quot;: { # An array value. # Append the given elements in order if they are not already present in the current field value. If the field is not an array, or if the field does not yet exist, it is first set to the empty array. Equivalent numbers of different types (e.g. 3L and 3.0) are considered equal when checking if a value is missing. NaN is equal to NaN, and Null is equal to Null. If the input contains multiple equivalent values, only the first will be considered. The corresponding transform_result will be the null value.
             &quot;values&quot;: [ # Values in the array.
-              { # A message that can hold any of the supported value types.
-                &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                &quot;booleanValue&quot;: True or False, # A boolean value.
-                &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                &quot;doubleValue&quot;: 3.14, # A double value.
-                &quot;geoPointValue&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                  &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                  &quot;longitude&quot;: 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                },
-                &quot;integerValue&quot;: &quot;A String&quot;, # An integer value.
-                &quot;mapValue&quot;: { # A map value. # A map value.
-                  &quot;fields&quot;: { # The map&#x27;s fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                    &quot;a_key&quot;: # Object with schema name: Value
-                  },
-                },
-                &quot;nullValue&quot;: &quot;A String&quot;, # A null value.
-                &quot;referenceValue&quot;: &quot;A String&quot;, # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                &quot;stringValue&quot;: &quot;A String&quot;, # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                &quot;timestampValue&quot;: &quot;A String&quot;, # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-              },
+              # Object with schema name: Value
             ],
           },
           &quot;fieldPath&quot;: &quot;A String&quot;, # The path of the field. See Document.fields for the field path syntax reference.
           &quot;increment&quot;: { # A message that can hold any of the supported value types. # Adds the given value to the field&#x27;s current value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If either of the given value or the current field value are doubles, both values will be interpreted as doubles. Double arithmetic and representation of double values follow IEEE 754 semantics. If there is positive/negative integer overflow, the field is resolved to the largest magnitude positive/negative integer.
-            &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              &quot;values&quot;: [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             &quot;booleanValue&quot;: True or False, # A boolean value.
             &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             &quot;doubleValue&quot;: 3.14, # A double value.
@@ -794,7 +717,11 @@
             &quot;timestampValue&quot;: &quot;A String&quot;, # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
           },
           &quot;maximum&quot;: { # A message that can hold any of the supported value types. # Sets the field to the maximum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If a maximum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the larger operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The maximum of a zero stored value and zero input value is always the stored value. The maximum of any numeric value x and NaN is NaN.
-            &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              &quot;values&quot;: [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             &quot;booleanValue&quot;: True or False, # A boolean value.
             &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             &quot;doubleValue&quot;: 3.14, # A double value.
@@ -814,7 +741,11 @@
             &quot;timestampValue&quot;: &quot;A String&quot;, # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
           },
           &quot;minimum&quot;: { # A message that can hold any of the supported value types. # Sets the field to the minimum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the input value. If a minimum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the smaller operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The minimum of a zero stored value and zero input value is always the stored value. The minimum of any numeric value x and NaN is NaN.
-            &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              &quot;values&quot;: [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             &quot;booleanValue&quot;: True or False, # A boolean value.
             &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             &quot;doubleValue&quot;: 3.14, # A double value.
@@ -835,26 +766,7 @@
           },
           &quot;removeAllFromArray&quot;: { # An array value. # Remove all of the given elements from the array in the field. If the field is not an array, or if the field does not yet exist, it is set to the empty array. Equivalent numbers of the different types (e.g. 3L and 3.0) are considered equal when deciding whether an element should be removed. NaN is equal to NaN, and Null is equal to Null. This will remove all equivalent values if there are duplicates. The corresponding transform_result will be the null value.
             &quot;values&quot;: [ # Values in the array.
-              { # A message that can hold any of the supported value types.
-                &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                &quot;booleanValue&quot;: True or False, # A boolean value.
-                &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                &quot;doubleValue&quot;: 3.14, # A double value.
-                &quot;geoPointValue&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                  &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                  &quot;longitude&quot;: 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                },
-                &quot;integerValue&quot;: &quot;A String&quot;, # An integer value.
-                &quot;mapValue&quot;: { # A map value. # A map value.
-                  &quot;fields&quot;: { # The map&#x27;s fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                    &quot;a_key&quot;: # Object with schema name: Value
-                  },
-                },
-                &quot;nullValue&quot;: &quot;A String&quot;, # A null value.
-                &quot;referenceValue&quot;: &quot;A String&quot;, # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                &quot;stringValue&quot;: &quot;A String&quot;, # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                &quot;timestampValue&quot;: &quot;A String&quot;, # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-              },
+              # Object with schema name: Value
             ],
           },
           &quot;setToServerValue&quot;: &quot;A String&quot;, # Sets the field to the given server value.
@@ -878,7 +790,11 @@
     { # The result of applying a write.
       &quot;transformResults&quot;: [ # The results of applying each DocumentTransform.FieldTransform, in the same order.
         { # A message that can hold any of the supported value types.
-          &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            &quot;values&quot;: [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           &quot;booleanValue&quot;: True or False, # A boolean value.
           &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           &quot;doubleValue&quot;: 3.14, # A double value.
@@ -918,7 +834,11 @@
   &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
   &quot;fields&quot;: { # The document&#x27;s fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `&quot;foo&quot; : { map_value: { &quot;x&amp;y&quot; : { string_value: &quot;hello&quot; }}}` would be represented by the field path `foo.x&amp;y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&amp;y` `` represents `x&amp;y` and `` `bak\`tik` `` represents `` bak`tik ``.
     &quot;a_key&quot;: { # A message that can hold any of the supported value types.
-      &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+      &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+        &quot;values&quot;: [ # Values in the array.
+          # Object with schema name: Value
+        ],
+      },
       &quot;booleanValue&quot;: True or False, # A boolean value.
       &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
       &quot;doubleValue&quot;: 3.14, # A double value.
@@ -956,7 +876,11 @@
   &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
   &quot;fields&quot;: { # The document&#x27;s fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `&quot;foo&quot; : { map_value: { &quot;x&amp;y&quot; : { string_value: &quot;hello&quot; }}}` would be represented by the field path `foo.x&amp;y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&amp;y` `` represents `x&amp;y` and `` `bak\`tik` `` represents `` bak`tik ``.
     &quot;a_key&quot;: { # A message that can hold any of the supported value types.
-      &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+      &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+        &quot;values&quot;: [ # Values in the array.
+          # Object with schema name: Value
+        ],
+      },
       &quot;booleanValue&quot;: True or False, # A boolean value.
       &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
       &quot;doubleValue&quot;: 3.14, # A double value.
@@ -1022,7 +946,11 @@
   &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
   &quot;fields&quot;: { # The document&#x27;s fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `&quot;foo&quot; : { map_value: { &quot;x&amp;y&quot; : { string_value: &quot;hello&quot; }}}` would be represented by the field path `foo.x&amp;y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&amp;y` `` represents `x&amp;y` and `` `bak\`tik` `` represents `` bak`tik ``.
     &quot;a_key&quot;: { # A message that can hold any of the supported value types.
-      &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+      &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+        &quot;values&quot;: [ # Values in the array.
+          # Object with schema name: Value
+        ],
+      },
       &quot;booleanValue&quot;: True or False, # A boolean value.
       &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
       &quot;doubleValue&quot;: 3.14, # A double value.
@@ -1075,7 +1003,11 @@
       &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
       &quot;fields&quot;: { # The document&#x27;s fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `&quot;foo&quot; : { map_value: { &quot;x&amp;y&quot; : { string_value: &quot;hello&quot; }}}` would be represented by the field path `foo.x&amp;y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&amp;y` `` represents `x&amp;y` and `` `bak\`tik` `` represents `` bak`tik ``.
         &quot;a_key&quot;: { # A message that can hold any of the supported value types.
-          &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            &quot;values&quot;: [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           &quot;booleanValue&quot;: True or False, # A boolean value.
           &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           &quot;doubleValue&quot;: 3.14, # A double value.
@@ -1185,7 +1117,11 @@
           &quot;before&quot;: True or False, # If the position is just before or just after the given values, relative to the sort order defined by the query.
           &quot;values&quot;: [ # The values that represent a position, in the order they appear in the order by clause of a query. Can contain fewer values than specified in the order by clause.
             { # A message that can hold any of the supported value types.
-              &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                &quot;values&quot;: [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               &quot;booleanValue&quot;: True or False, # A boolean value.
               &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               &quot;doubleValue&quot;: 3.14, # A double value.
@@ -1233,7 +1169,11 @@
           &quot;before&quot;: True or False, # If the position is just before or just after the given values, relative to the sort order defined by the query.
           &quot;values&quot;: [ # The values that represent a position, in the order they appear in the order by clause of a query. Can contain fewer values than specified in the order by clause.
             { # A message that can hold any of the supported value types.
-              &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                &quot;values&quot;: [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               &quot;booleanValue&quot;: True or False, # A boolean value.
               &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               &quot;doubleValue&quot;: 3.14, # A double value.
@@ -1267,7 +1207,11 @@
             },
             &quot;op&quot;: &quot;A String&quot;, # The operator to filter by.
             &quot;value&quot;: { # A message that can hold any of the supported value types. # The value to compare to.
-              &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                &quot;values&quot;: [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               &quot;booleanValue&quot;: True or False, # A boolean value.
               &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               &quot;doubleValue&quot;: 3.14, # A double value.
@@ -1320,7 +1264,11 @@
       &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
       &quot;fields&quot;: { # The document&#x27;s fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `&quot;foo&quot; : { map_value: { &quot;x&amp;y&quot; : { string_value: &quot;hello&quot; }}}` would be represented by the field path `foo.x&amp;y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&amp;y` `` represents `x&amp;y` and `` `bak\`tik` `` represents `` bak`tik ``.
         &quot;a_key&quot;: { # A message that can hold any of the supported value types.
-          &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            &quot;values&quot;: [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           &quot;booleanValue&quot;: True or False, # A boolean value.
           &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           &quot;doubleValue&quot;: 3.14, # A double value.
@@ -1406,7 +1354,11 @@
       &quot;before&quot;: True or False, # If the position is just before or just after the given values, relative to the sort order defined by the query.
       &quot;values&quot;: [ # The values that represent a position, in the order they appear in the order by clause of a query. Can contain fewer values than specified in the order by clause.
         { # A message that can hold any of the supported value types.
-          &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            &quot;values&quot;: [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           &quot;booleanValue&quot;: True or False, # A boolean value.
           &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           &quot;doubleValue&quot;: 3.14, # A double value.
@@ -1454,7 +1406,11 @@
       &quot;before&quot;: True or False, # If the position is just before or just after the given values, relative to the sort order defined by the query.
       &quot;values&quot;: [ # The values that represent a position, in the order they appear in the order by clause of a query. Can contain fewer values than specified in the order by clause.
         { # A message that can hold any of the supported value types.
-          &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            &quot;values&quot;: [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           &quot;booleanValue&quot;: True or False, # A boolean value.
           &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           &quot;doubleValue&quot;: 3.14, # A double value.
@@ -1488,7 +1444,11 @@
         },
         &quot;op&quot;: &quot;A String&quot;, # The operator to filter by.
         &quot;value&quot;: { # A message that can hold any of the supported value types. # The value to compare to.
-          &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            &quot;values&quot;: [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           &quot;booleanValue&quot;: True or False, # A boolean value.
           &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           &quot;doubleValue&quot;: 3.14, # A double value.
@@ -1533,7 +1493,11 @@
       &quot;before&quot;: True or False, # If the position is just before or just after the given values, relative to the sort order defined by the query.
       &quot;values&quot;: [ # The values that represent a position, in the order they appear in the order by clause of a query. Can contain fewer values than specified in the order by clause.
         { # A message that can hold any of the supported value types.
-          &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            &quot;values&quot;: [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           &quot;booleanValue&quot;: True or False, # A boolean value.
           &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           &quot;doubleValue&quot;: 3.14, # A double value.
@@ -1585,7 +1549,11 @@
   &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
   &quot;fields&quot;: { # The document&#x27;s fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `&quot;foo&quot; : { map_value: { &quot;x&amp;y&quot; : { string_value: &quot;hello&quot; }}}` would be represented by the field path `foo.x&amp;y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&amp;y` `` represents `x&amp;y` and `` `bak\`tik` `` represents `` bak`tik ``.
     &quot;a_key&quot;: { # A message that can hold any of the supported value types.
-      &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+      &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+        &quot;values&quot;: [ # Values in the array.
+          # Object with schema name: Value
+        ],
+      },
       &quot;booleanValue&quot;: True or False, # A boolean value.
       &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
       &quot;doubleValue&quot;: 3.14, # A double value.
@@ -1625,7 +1593,11 @@
   &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
   &quot;fields&quot;: { # The document&#x27;s fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `&quot;foo&quot; : { map_value: { &quot;x&amp;y&quot; : { string_value: &quot;hello&quot; }}}` would be represented by the field path `foo.x&amp;y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&amp;y` `` represents `x&amp;y` and `` `bak\`tik` `` represents `` bak`tik ``.
     &quot;a_key&quot;: { # A message that can hold any of the supported value types.
-      &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+      &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+        &quot;values&quot;: [ # Values in the array.
+          # Object with schema name: Value
+        ],
+      },
       &quot;booleanValue&quot;: True or False, # A boolean value.
       &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
       &quot;doubleValue&quot;: 3.14, # A double value.
@@ -1699,7 +1671,11 @@
       &quot;before&quot;: True or False, # If the position is just before or just after the given values, relative to the sort order defined by the query.
       &quot;values&quot;: [ # The values that represent a position, in the order they appear in the order by clause of a query. Can contain fewer values than specified in the order by clause.
         { # A message that can hold any of the supported value types.
-          &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            &quot;values&quot;: [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           &quot;booleanValue&quot;: True or False, # A boolean value.
           &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           &quot;doubleValue&quot;: 3.14, # A double value.
@@ -1747,7 +1723,11 @@
       &quot;before&quot;: True or False, # If the position is just before or just after the given values, relative to the sort order defined by the query.
       &quot;values&quot;: [ # The values that represent a position, in the order they appear in the order by clause of a query. Can contain fewer values than specified in the order by clause.
         { # A message that can hold any of the supported value types.
-          &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            &quot;values&quot;: [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           &quot;booleanValue&quot;: True or False, # A boolean value.
           &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           &quot;doubleValue&quot;: 3.14, # A double value.
@@ -1781,7 +1761,11 @@
         },
         &quot;op&quot;: &quot;A String&quot;, # The operator to filter by.
         &quot;value&quot;: { # A message that can hold any of the supported value types. # The value to compare to.
-          &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            &quot;values&quot;: [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           &quot;booleanValue&quot;: True or False, # A boolean value.
           &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           &quot;doubleValue&quot;: 3.14, # A double value.
@@ -1825,7 +1809,11 @@
     &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
     &quot;fields&quot;: { # The document&#x27;s fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `&quot;foo&quot; : { map_value: { &quot;x&amp;y&quot; : { string_value: &quot;hello&quot; }}}` would be represented by the field path `foo.x&amp;y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&amp;y` `` represents `x&amp;y` and `` `bak\`tik` `` represents `` bak`tik ``.
       &quot;a_key&quot;: { # A message that can hold any of the supported value types.
-        &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+        &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          &quot;values&quot;: [ # Values in the array.
+            # Object with schema name: Value
+          ],
+        },
         &quot;booleanValue&quot;: True or False, # A boolean value.
         &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
         &quot;doubleValue&quot;: 3.14, # A double value.
@@ -1882,31 +1870,16 @@
           { # A transformation of a field of the document.
             &quot;appendMissingElements&quot;: { # An array value. # Append the given elements in order if they are not already present in the current field value. If the field is not an array, or if the field does not yet exist, it is first set to the empty array. Equivalent numbers of different types (e.g. 3L and 3.0) are considered equal when checking if a value is missing. NaN is equal to NaN, and Null is equal to Null. If the input contains multiple equivalent values, only the first will be considered. The corresponding transform_result will be the null value.
               &quot;values&quot;: [ # Values in the array.
-                { # A message that can hold any of the supported value types.
-                  &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                  &quot;booleanValue&quot;: True or False, # A boolean value.
-                  &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                  &quot;doubleValue&quot;: 3.14, # A double value.
-                  &quot;geoPointValue&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                    &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                    &quot;longitude&quot;: 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                  },
-                  &quot;integerValue&quot;: &quot;A String&quot;, # An integer value.
-                  &quot;mapValue&quot;: { # A map value. # A map value.
-                    &quot;fields&quot;: { # The map&#x27;s fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                      &quot;a_key&quot;: # Object with schema name: Value
-                    },
-                  },
-                  &quot;nullValue&quot;: &quot;A String&quot;, # A null value.
-                  &quot;referenceValue&quot;: &quot;A String&quot;, # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                  &quot;stringValue&quot;: &quot;A String&quot;, # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                  &quot;timestampValue&quot;: &quot;A String&quot;, # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-                },
+                # Object with schema name: Value
               ],
             },
             &quot;fieldPath&quot;: &quot;A String&quot;, # The path of the field. See Document.fields for the field path syntax reference.
             &quot;increment&quot;: { # A message that can hold any of the supported value types. # Adds the given value to the field&#x27;s current value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If either of the given value or the current field value are doubles, both values will be interpreted as doubles. Double arithmetic and representation of double values follow IEEE 754 semantics. If there is positive/negative integer overflow, the field is resolved to the largest magnitude positive/negative integer.
-              &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                &quot;values&quot;: [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               &quot;booleanValue&quot;: True or False, # A boolean value.
               &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               &quot;doubleValue&quot;: 3.14, # A double value.
@@ -1926,7 +1899,11 @@
               &quot;timestampValue&quot;: &quot;A String&quot;, # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
             },
             &quot;maximum&quot;: { # A message that can hold any of the supported value types. # Sets the field to the maximum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If a maximum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the larger operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The maximum of a zero stored value and zero input value is always the stored value. The maximum of any numeric value x and NaN is NaN.
-              &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                &quot;values&quot;: [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               &quot;booleanValue&quot;: True or False, # A boolean value.
               &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               &quot;doubleValue&quot;: 3.14, # A double value.
@@ -1946,7 +1923,11 @@
               &quot;timestampValue&quot;: &quot;A String&quot;, # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
             },
             &quot;minimum&quot;: { # A message that can hold any of the supported value types. # Sets the field to the minimum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the input value. If a minimum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the smaller operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The minimum of a zero stored value and zero input value is always the stored value. The minimum of any numeric value x and NaN is NaN.
-              &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+                &quot;values&quot;: [ # Values in the array.
+                  # Object with schema name: Value
+                ],
+              },
               &quot;booleanValue&quot;: True or False, # A boolean value.
               &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
               &quot;doubleValue&quot;: 3.14, # A double value.
@@ -1967,26 +1948,7 @@
             },
             &quot;removeAllFromArray&quot;: { # An array value. # Remove all of the given elements from the array in the field. If the field is not an array, or if the field does not yet exist, it is set to the empty array. Equivalent numbers of the different types (e.g. 3L and 3.0) are considered equal when deciding whether an element should be removed. NaN is equal to NaN, and Null is equal to Null. This will remove all equivalent values if there are duplicates. The corresponding transform_result will be the null value.
               &quot;values&quot;: [ # Values in the array.
-                { # A message that can hold any of the supported value types.
-                  &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                  &quot;booleanValue&quot;: True or False, # A boolean value.
-                  &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                  &quot;doubleValue&quot;: 3.14, # A double value.
-                  &quot;geoPointValue&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                    &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                    &quot;longitude&quot;: 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                  },
-                  &quot;integerValue&quot;: &quot;A String&quot;, # An integer value.
-                  &quot;mapValue&quot;: { # A map value. # A map value.
-                    &quot;fields&quot;: { # The map&#x27;s fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                      &quot;a_key&quot;: # Object with schema name: Value
-                    },
-                  },
-                  &quot;nullValue&quot;: &quot;A String&quot;, # A null value.
-                  &quot;referenceValue&quot;: &quot;A String&quot;, # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                  &quot;stringValue&quot;: &quot;A String&quot;, # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                  &quot;timestampValue&quot;: &quot;A String&quot;, # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-                },
+                # Object with schema name: Value
               ],
             },
             &quot;setToServerValue&quot;: &quot;A String&quot;, # Sets the field to the given server value.
@@ -1997,7 +1959,11 @@
         &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time at which the document was created. This value increases monotonically when a document is deleted then recreated. It can also be compared to values from other documents and the `read_time` of a query.
         &quot;fields&quot;: { # The document&#x27;s fields. The map keys represent field names. A simple field name contains only characters `a` to `z`, `A` to `Z`, `0` to `9`, or `_`, and must not start with `0` to `9`. For example, `foo_bar_17`. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty. Field paths may be used in other contexts to refer to structured fields defined here. For `map_value`, the field path is represented by the simple or quoted field names of the containing fields, delimited by `.`. For example, the structured field `&quot;foo&quot; : { map_value: { &quot;x&amp;y&quot; : { string_value: &quot;hello&quot; }}}` would be represented by the field path `foo.x&amp;y`. Within a field path, a quoted field name starts and ends with `` ` `` and may contain any character. Some characters, including `` ` ``, must be escaped using a `\`. For example, `` `x&amp;y` `` represents `x&amp;y` and `` `bak\`tik` `` represents `` bak`tik ``.
           &quot;a_key&quot;: { # A message that can hold any of the supported value types.
-            &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              &quot;values&quot;: [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             &quot;booleanValue&quot;: True or False, # A boolean value.
             &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             &quot;doubleValue&quot;: 3.14, # A double value.
@@ -2029,31 +1995,16 @@
         { # A transformation of a field of the document.
           &quot;appendMissingElements&quot;: { # An array value. # Append the given elements in order if they are not already present in the current field value. If the field is not an array, or if the field does not yet exist, it is first set to the empty array. Equivalent numbers of different types (e.g. 3L and 3.0) are considered equal when checking if a value is missing. NaN is equal to NaN, and Null is equal to Null. If the input contains multiple equivalent values, only the first will be considered. The corresponding transform_result will be the null value.
             &quot;values&quot;: [ # Values in the array.
-              { # A message that can hold any of the supported value types.
-                &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                &quot;booleanValue&quot;: True or False, # A boolean value.
-                &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                &quot;doubleValue&quot;: 3.14, # A double value.
-                &quot;geoPointValue&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                  &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                  &quot;longitude&quot;: 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                },
-                &quot;integerValue&quot;: &quot;A String&quot;, # An integer value.
-                &quot;mapValue&quot;: { # A map value. # A map value.
-                  &quot;fields&quot;: { # The map&#x27;s fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                    &quot;a_key&quot;: # Object with schema name: Value
-                  },
-                },
-                &quot;nullValue&quot;: &quot;A String&quot;, # A null value.
-                &quot;referenceValue&quot;: &quot;A String&quot;, # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                &quot;stringValue&quot;: &quot;A String&quot;, # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                &quot;timestampValue&quot;: &quot;A String&quot;, # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-              },
+              # Object with schema name: Value
             ],
           },
           &quot;fieldPath&quot;: &quot;A String&quot;, # The path of the field. See Document.fields for the field path syntax reference.
           &quot;increment&quot;: { # A message that can hold any of the supported value types. # Adds the given value to the field&#x27;s current value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If either of the given value or the current field value are doubles, both values will be interpreted as doubles. Double arithmetic and representation of double values follow IEEE 754 semantics. If there is positive/negative integer overflow, the field is resolved to the largest magnitude positive/negative integer.
-            &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              &quot;values&quot;: [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             &quot;booleanValue&quot;: True or False, # A boolean value.
             &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             &quot;doubleValue&quot;: 3.14, # A double value.
@@ -2073,7 +2024,11 @@
             &quot;timestampValue&quot;: &quot;A String&quot;, # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
           },
           &quot;maximum&quot;: { # A message that can hold any of the supported value types. # Sets the field to the maximum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the given value. If a maximum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the larger operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The maximum of a zero stored value and zero input value is always the stored value. The maximum of any numeric value x and NaN is NaN.
-            &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              &quot;values&quot;: [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             &quot;booleanValue&quot;: True or False, # A boolean value.
             &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             &quot;doubleValue&quot;: 3.14, # A double value.
@@ -2093,7 +2048,11 @@
             &quot;timestampValue&quot;: &quot;A String&quot;, # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
           },
           &quot;minimum&quot;: { # A message that can hold any of the supported value types. # Sets the field to the minimum of its current value and the given value. This must be an integer or a double value. If the field is not an integer or double, or if the field does not yet exist, the transformation will set the field to the input value. If a minimum operation is applied where the field and the input value are of mixed types (that is - one is an integer and one is a double) the field takes on the type of the smaller operand. If the operands are equivalent (e.g. 3 and 3.0), the field does not change. 0, 0.0, and -0.0 are all zero. The minimum of a zero stored value and zero input value is always the stored value. The minimum of any numeric value x and NaN is NaN.
-            &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+              &quot;values&quot;: [ # Values in the array.
+                # Object with schema name: Value
+              ],
+            },
             &quot;booleanValue&quot;: True or False, # A boolean value.
             &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
             &quot;doubleValue&quot;: 3.14, # A double value.
@@ -2114,26 +2073,7 @@
           },
           &quot;removeAllFromArray&quot;: { # An array value. # Remove all of the given elements from the array in the field. If the field is not an array, or if the field does not yet exist, it is set to the empty array. Equivalent numbers of the different types (e.g. 3L and 3.0) are considered equal when deciding whether an element should be removed. NaN is equal to NaN, and Null is equal to Null. This will remove all equivalent values if there are duplicates. The corresponding transform_result will be the null value.
             &quot;values&quot;: [ # Values in the array.
-              { # A message that can hold any of the supported value types.
-                &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
-                &quot;booleanValue&quot;: True or False, # A boolean value.
-                &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
-                &quot;doubleValue&quot;: 3.14, # A double value.
-                &quot;geoPointValue&quot;: { # An object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges. # A geo point value representing a point on the surface of Earth.
-                  &quot;latitude&quot;: 3.14, # The latitude in degrees. It must be in the range [-90.0, +90.0].
-                  &quot;longitude&quot;: 3.14, # The longitude in degrees. It must be in the range [-180.0, +180.0].
-                },
-                &quot;integerValue&quot;: &quot;A String&quot;, # An integer value.
-                &quot;mapValue&quot;: { # A map value. # A map value.
-                  &quot;fields&quot;: { # The map&#x27;s fields. The map keys represent field names. Field names matching the regular expression `__.*__` are reserved. Reserved field names are forbidden except in certain documented contexts. The map keys, represented as UTF-8, must not exceed 1,500 bytes and cannot be empty.
-                    &quot;a_key&quot;: # Object with schema name: Value
-                  },
-                },
-                &quot;nullValue&quot;: &quot;A String&quot;, # A null value.
-                &quot;referenceValue&quot;: &quot;A String&quot;, # A reference to a document. For example: `projects/{project_id}/databases/{database_id}/documents/{document_path}`.
-                &quot;stringValue&quot;: &quot;A String&quot;, # A string value. The string, represented as UTF-8, must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes of the UTF-8 representation are considered by queries.
-                &quot;timestampValue&quot;: &quot;A String&quot;, # A timestamp value. Precise only to microseconds. When stored, any additional precision is rounded down.
-              },
+              # Object with schema name: Value
             ],
           },
           &quot;setToServerValue&quot;: &quot;A String&quot;, # Sets the field to the given server value.
@@ -2159,7 +2099,11 @@
     { # The result of applying a write.
       &quot;transformResults&quot;: [ # The results of applying each DocumentTransform.FieldTransform, in the same order.
         { # A message that can hold any of the supported value types.
-          &quot;arrayValue&quot;: # Object with schema name: ArrayValue # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+          &quot;arrayValue&quot;: { # An array value. # An array value. Cannot directly contain another array value, though can contain an map which contains another array.
+            &quot;values&quot;: [ # Values in the array.
+              # Object with schema name: Value
+            ],
+          },
           &quot;booleanValue&quot;: True or False, # A boolean value.
           &quot;bytesValue&quot;: &quot;A String&quot;, # A bytes value. Must not exceed 1 MiB - 89 bytes. Only the first 1,500 bytes are considered by queries.
           &quot;doubleValue&quot;: 3.14, # A double value.
diff --git a/docs/dyn/gkehub_v1.projects.locations.features.html b/docs/dyn/gkehub_v1.projects.locations.features.html
index 89b3905..c54959c 100644
--- a/docs/dyn/gkehub_v1.projects.locations.features.html
+++ b/docs/dyn/gkehub_v1.projects.locations.features.html
@@ -132,26 +132,13 @@
           &quot;git&quot;: { # Git repo configuration for a single cluster. # Git repo configuration for the cluster.
             &quot;gcpServiceAccountEmail&quot;: &quot;A String&quot;, # The GCP Service Account Email used for auth when secret_type is gcpServiceAccount.
             &quot;httpsProxy&quot;: &quot;A String&quot;, # URL for the HTTPS proxy to be used when communicating with the Git repo.
-            &quot;noSslVerify&quot;: True or False, # Enable or disable the SSL certificate verification Default: false.
             &quot;policyDir&quot;: &quot;A String&quot;, # The path within the Git repository that represents the top level of the repo to sync. Default: the root directory of the repository.
             &quot;secretType&quot;: &quot;A String&quot;, # Type of secret configured for access to the Git repo.
             &quot;syncBranch&quot;: &quot;A String&quot;, # The branch of the repository to sync from. Default: master.
-            &quot;syncDepth&quot;: &quot;A String&quot;, # The depth of git commits synced by the git-sync container.
             &quot;syncRepo&quot;: &quot;A String&quot;, # The URL of the Git repository to use as the source of truth.
             &quot;syncRev&quot;: &quot;A String&quot;, # Git revision (tag or hash) to check out. Default HEAD.
             &quot;syncWaitSecs&quot;: &quot;A String&quot;, # Period in seconds between consecutive syncs. Default: 15.
           },
-          &quot;resourceRequirements&quot;: { # Specifies CPU and memory limits for containers, keyed by container name
-            &quot;a_key&quot;: { # ResourceRequirements allows to override the CPU and memory resource requirements of a container.
-              &quot;containerName&quot;: &quot;A String&quot;, # Name of the container
-              &quot;cpuLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the CPU limit of a container
-                &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-              },
-              &quot;memoryLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the memory limit of a container
-                &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-              },
-            },
-          },
           &quot;sourceFormat&quot;: &quot;A String&quot;, # Specifies whether the Config Sync Repo is in “hierarchical” or “unstructured” mode.
         },
         &quot;hierarchyController&quot;: { # Configuration for Hierarchy Controller # Hierarchy Controller configuration for the cluster.
@@ -238,26 +225,13 @@
             &quot;git&quot;: { # Git repo configuration for a single cluster. # Git repo configuration for the cluster.
               &quot;gcpServiceAccountEmail&quot;: &quot;A String&quot;, # The GCP Service Account Email used for auth when secret_type is gcpServiceAccount.
               &quot;httpsProxy&quot;: &quot;A String&quot;, # URL for the HTTPS proxy to be used when communicating with the Git repo.
-              &quot;noSslVerify&quot;: True or False, # Enable or disable the SSL certificate verification Default: false.
               &quot;policyDir&quot;: &quot;A String&quot;, # The path within the Git repository that represents the top level of the repo to sync. Default: the root directory of the repository.
               &quot;secretType&quot;: &quot;A String&quot;, # Type of secret configured for access to the Git repo.
               &quot;syncBranch&quot;: &quot;A String&quot;, # The branch of the repository to sync from. Default: master.
-              &quot;syncDepth&quot;: &quot;A String&quot;, # The depth of git commits synced by the git-sync container.
               &quot;syncRepo&quot;: &quot;A String&quot;, # The URL of the Git repository to use as the source of truth.
               &quot;syncRev&quot;: &quot;A String&quot;, # Git revision (tag or hash) to check out. Default HEAD.
               &quot;syncWaitSecs&quot;: &quot;A String&quot;, # Period in seconds between consecutive syncs. Default: 15.
             },
-            &quot;resourceRequirements&quot;: { # Specifies CPU and memory limits for containers, keyed by container name
-              &quot;a_key&quot;: { # ResourceRequirements allows to override the CPU and memory resource requirements of a container.
-                &quot;containerName&quot;: &quot;A String&quot;, # Name of the container
-                &quot;cpuLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the CPU limit of a container
-                  &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-                },
-                &quot;memoryLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the memory limit of a container
-                  &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-                },
-              },
-            },
             &quot;sourceFormat&quot;: &quot;A String&quot;, # Specifies whether the Config Sync Repo is in “hierarchical” or “unstructured” mode.
           },
           &quot;hierarchyController&quot;: { # Configuration for Hierarchy Controller # Hierarchy Controller configuration for the cluster.
@@ -417,26 +391,13 @@
           &quot;git&quot;: { # Git repo configuration for a single cluster. # Git repo configuration for the cluster.
             &quot;gcpServiceAccountEmail&quot;: &quot;A String&quot;, # The GCP Service Account Email used for auth when secret_type is gcpServiceAccount.
             &quot;httpsProxy&quot;: &quot;A String&quot;, # URL for the HTTPS proxy to be used when communicating with the Git repo.
-            &quot;noSslVerify&quot;: True or False, # Enable or disable the SSL certificate verification Default: false.
             &quot;policyDir&quot;: &quot;A String&quot;, # The path within the Git repository that represents the top level of the repo to sync. Default: the root directory of the repository.
             &quot;secretType&quot;: &quot;A String&quot;, # Type of secret configured for access to the Git repo.
             &quot;syncBranch&quot;: &quot;A String&quot;, # The branch of the repository to sync from. Default: master.
-            &quot;syncDepth&quot;: &quot;A String&quot;, # The depth of git commits synced by the git-sync container.
             &quot;syncRepo&quot;: &quot;A String&quot;, # The URL of the Git repository to use as the source of truth.
             &quot;syncRev&quot;: &quot;A String&quot;, # Git revision (tag or hash) to check out. Default HEAD.
             &quot;syncWaitSecs&quot;: &quot;A String&quot;, # Period in seconds between consecutive syncs. Default: 15.
           },
-          &quot;resourceRequirements&quot;: { # Specifies CPU and memory limits for containers, keyed by container name
-            &quot;a_key&quot;: { # ResourceRequirements allows to override the CPU and memory resource requirements of a container.
-              &quot;containerName&quot;: &quot;A String&quot;, # Name of the container
-              &quot;cpuLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the CPU limit of a container
-                &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-              },
-              &quot;memoryLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the memory limit of a container
-                &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-              },
-            },
-          },
           &quot;sourceFormat&quot;: &quot;A String&quot;, # Specifies whether the Config Sync Repo is in “hierarchical” or “unstructured” mode.
         },
         &quot;hierarchyController&quot;: { # Configuration for Hierarchy Controller # Hierarchy Controller configuration for the cluster.
@@ -523,26 +484,13 @@
             &quot;git&quot;: { # Git repo configuration for a single cluster. # Git repo configuration for the cluster.
               &quot;gcpServiceAccountEmail&quot;: &quot;A String&quot;, # The GCP Service Account Email used for auth when secret_type is gcpServiceAccount.
               &quot;httpsProxy&quot;: &quot;A String&quot;, # URL for the HTTPS proxy to be used when communicating with the Git repo.
-              &quot;noSslVerify&quot;: True or False, # Enable or disable the SSL certificate verification Default: false.
               &quot;policyDir&quot;: &quot;A String&quot;, # The path within the Git repository that represents the top level of the repo to sync. Default: the root directory of the repository.
               &quot;secretType&quot;: &quot;A String&quot;, # Type of secret configured for access to the Git repo.
               &quot;syncBranch&quot;: &quot;A String&quot;, # The branch of the repository to sync from. Default: master.
-              &quot;syncDepth&quot;: &quot;A String&quot;, # The depth of git commits synced by the git-sync container.
               &quot;syncRepo&quot;: &quot;A String&quot;, # The URL of the Git repository to use as the source of truth.
               &quot;syncRev&quot;: &quot;A String&quot;, # Git revision (tag or hash) to check out. Default HEAD.
               &quot;syncWaitSecs&quot;: &quot;A String&quot;, # Period in seconds between consecutive syncs. Default: 15.
             },
-            &quot;resourceRequirements&quot;: { # Specifies CPU and memory limits for containers, keyed by container name
-              &quot;a_key&quot;: { # ResourceRequirements allows to override the CPU and memory resource requirements of a container.
-                &quot;containerName&quot;: &quot;A String&quot;, # Name of the container
-                &quot;cpuLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the CPU limit of a container
-                  &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-                },
-                &quot;memoryLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the memory limit of a container
-                  &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-                },
-              },
-            },
             &quot;sourceFormat&quot;: &quot;A String&quot;, # Specifies whether the Config Sync Repo is in “hierarchical” or “unstructured” mode.
           },
           &quot;hierarchyController&quot;: { # Configuration for Hierarchy Controller # Hierarchy Controller configuration for the cluster.
@@ -690,26 +638,13 @@
               &quot;git&quot;: { # Git repo configuration for a single cluster. # Git repo configuration for the cluster.
                 &quot;gcpServiceAccountEmail&quot;: &quot;A String&quot;, # The GCP Service Account Email used for auth when secret_type is gcpServiceAccount.
                 &quot;httpsProxy&quot;: &quot;A String&quot;, # URL for the HTTPS proxy to be used when communicating with the Git repo.
-                &quot;noSslVerify&quot;: True or False, # Enable or disable the SSL certificate verification Default: false.
                 &quot;policyDir&quot;: &quot;A String&quot;, # The path within the Git repository that represents the top level of the repo to sync. Default: the root directory of the repository.
                 &quot;secretType&quot;: &quot;A String&quot;, # Type of secret configured for access to the Git repo.
                 &quot;syncBranch&quot;: &quot;A String&quot;, # The branch of the repository to sync from. Default: master.
-                &quot;syncDepth&quot;: &quot;A String&quot;, # The depth of git commits synced by the git-sync container.
                 &quot;syncRepo&quot;: &quot;A String&quot;, # The URL of the Git repository to use as the source of truth.
                 &quot;syncRev&quot;: &quot;A String&quot;, # Git revision (tag or hash) to check out. Default HEAD.
                 &quot;syncWaitSecs&quot;: &quot;A String&quot;, # Period in seconds between consecutive syncs. Default: 15.
               },
-              &quot;resourceRequirements&quot;: { # Specifies CPU and memory limits for containers, keyed by container name
-                &quot;a_key&quot;: { # ResourceRequirements allows to override the CPU and memory resource requirements of a container.
-                  &quot;containerName&quot;: &quot;A String&quot;, # Name of the container
-                  &quot;cpuLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the CPU limit of a container
-                    &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-                  },
-                  &quot;memoryLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the memory limit of a container
-                    &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-                  },
-                },
-              },
               &quot;sourceFormat&quot;: &quot;A String&quot;, # Specifies whether the Config Sync Repo is in “hierarchical” or “unstructured” mode.
             },
             &quot;hierarchyController&quot;: { # Configuration for Hierarchy Controller # Hierarchy Controller configuration for the cluster.
@@ -796,26 +731,13 @@
                 &quot;git&quot;: { # Git repo configuration for a single cluster. # Git repo configuration for the cluster.
                   &quot;gcpServiceAccountEmail&quot;: &quot;A String&quot;, # The GCP Service Account Email used for auth when secret_type is gcpServiceAccount.
                   &quot;httpsProxy&quot;: &quot;A String&quot;, # URL for the HTTPS proxy to be used when communicating with the Git repo.
-                  &quot;noSslVerify&quot;: True or False, # Enable or disable the SSL certificate verification Default: false.
                   &quot;policyDir&quot;: &quot;A String&quot;, # The path within the Git repository that represents the top level of the repo to sync. Default: the root directory of the repository.
                   &quot;secretType&quot;: &quot;A String&quot;, # Type of secret configured for access to the Git repo.
                   &quot;syncBranch&quot;: &quot;A String&quot;, # The branch of the repository to sync from. Default: master.
-                  &quot;syncDepth&quot;: &quot;A String&quot;, # The depth of git commits synced by the git-sync container.
                   &quot;syncRepo&quot;: &quot;A String&quot;, # The URL of the Git repository to use as the source of truth.
                   &quot;syncRev&quot;: &quot;A String&quot;, # Git revision (tag or hash) to check out. Default HEAD.
                   &quot;syncWaitSecs&quot;: &quot;A String&quot;, # Period in seconds between consecutive syncs. Default: 15.
                 },
-                &quot;resourceRequirements&quot;: { # Specifies CPU and memory limits for containers, keyed by container name
-                  &quot;a_key&quot;: { # ResourceRequirements allows to override the CPU and memory resource requirements of a container.
-                    &quot;containerName&quot;: &quot;A String&quot;, # Name of the container
-                    &quot;cpuLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the CPU limit of a container
-                      &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-                    },
-                    &quot;memoryLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the memory limit of a container
-                      &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-                    },
-                  },
-                },
                 &quot;sourceFormat&quot;: &quot;A String&quot;, # Specifies whether the Config Sync Repo is in “hierarchical” or “unstructured” mode.
               },
               &quot;hierarchyController&quot;: { # Configuration for Hierarchy Controller # Hierarchy Controller configuration for the cluster.
@@ -919,26 +841,13 @@
           &quot;git&quot;: { # Git repo configuration for a single cluster. # Git repo configuration for the cluster.
             &quot;gcpServiceAccountEmail&quot;: &quot;A String&quot;, # The GCP Service Account Email used for auth when secret_type is gcpServiceAccount.
             &quot;httpsProxy&quot;: &quot;A String&quot;, # URL for the HTTPS proxy to be used when communicating with the Git repo.
-            &quot;noSslVerify&quot;: True or False, # Enable or disable the SSL certificate verification Default: false.
             &quot;policyDir&quot;: &quot;A String&quot;, # The path within the Git repository that represents the top level of the repo to sync. Default: the root directory of the repository.
             &quot;secretType&quot;: &quot;A String&quot;, # Type of secret configured for access to the Git repo.
             &quot;syncBranch&quot;: &quot;A String&quot;, # The branch of the repository to sync from. Default: master.
-            &quot;syncDepth&quot;: &quot;A String&quot;, # The depth of git commits synced by the git-sync container.
             &quot;syncRepo&quot;: &quot;A String&quot;, # The URL of the Git repository to use as the source of truth.
             &quot;syncRev&quot;: &quot;A String&quot;, # Git revision (tag or hash) to check out. Default HEAD.
             &quot;syncWaitSecs&quot;: &quot;A String&quot;, # Period in seconds between consecutive syncs. Default: 15.
           },
-          &quot;resourceRequirements&quot;: { # Specifies CPU and memory limits for containers, keyed by container name
-            &quot;a_key&quot;: { # ResourceRequirements allows to override the CPU and memory resource requirements of a container.
-              &quot;containerName&quot;: &quot;A String&quot;, # Name of the container
-              &quot;cpuLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the CPU limit of a container
-                &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-              },
-              &quot;memoryLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the memory limit of a container
-                &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-              },
-            },
-          },
           &quot;sourceFormat&quot;: &quot;A String&quot;, # Specifies whether the Config Sync Repo is in “hierarchical” or “unstructured” mode.
         },
         &quot;hierarchyController&quot;: { # Configuration for Hierarchy Controller # Hierarchy Controller configuration for the cluster.
@@ -1025,26 +934,13 @@
             &quot;git&quot;: { # Git repo configuration for a single cluster. # Git repo configuration for the cluster.
               &quot;gcpServiceAccountEmail&quot;: &quot;A String&quot;, # The GCP Service Account Email used for auth when secret_type is gcpServiceAccount.
               &quot;httpsProxy&quot;: &quot;A String&quot;, # URL for the HTTPS proxy to be used when communicating with the Git repo.
-              &quot;noSslVerify&quot;: True or False, # Enable or disable the SSL certificate verification Default: false.
               &quot;policyDir&quot;: &quot;A String&quot;, # The path within the Git repository that represents the top level of the repo to sync. Default: the root directory of the repository.
               &quot;secretType&quot;: &quot;A String&quot;, # Type of secret configured for access to the Git repo.
               &quot;syncBranch&quot;: &quot;A String&quot;, # The branch of the repository to sync from. Default: master.
-              &quot;syncDepth&quot;: &quot;A String&quot;, # The depth of git commits synced by the git-sync container.
               &quot;syncRepo&quot;: &quot;A String&quot;, # The URL of the Git repository to use as the source of truth.
               &quot;syncRev&quot;: &quot;A String&quot;, # Git revision (tag or hash) to check out. Default HEAD.
               &quot;syncWaitSecs&quot;: &quot;A String&quot;, # Period in seconds between consecutive syncs. Default: 15.
             },
-            &quot;resourceRequirements&quot;: { # Specifies CPU and memory limits for containers, keyed by container name
-              &quot;a_key&quot;: { # ResourceRequirements allows to override the CPU and memory resource requirements of a container.
-                &quot;containerName&quot;: &quot;A String&quot;, # Name of the container
-                &quot;cpuLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the CPU limit of a container
-                  &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-                },
-                &quot;memoryLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the memory limit of a container
-                  &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-                },
-              },
-            },
             &quot;sourceFormat&quot;: &quot;A String&quot;, # Specifies whether the Config Sync Repo is in “hierarchical” or “unstructured” mode.
           },
           &quot;hierarchyController&quot;: { # Configuration for Hierarchy Controller # Hierarchy Controller configuration for the cluster.
diff --git a/docs/dyn/gkehub_v1alpha.projects.locations.features.html b/docs/dyn/gkehub_v1alpha.projects.locations.features.html
index a732ed2..8dc7599 100644
--- a/docs/dyn/gkehub_v1alpha.projects.locations.features.html
+++ b/docs/dyn/gkehub_v1alpha.projects.locations.features.html
@@ -132,29 +132,17 @@
           &quot;enabled&quot;: True or False, # Whether binauthz is enabled in this cluster.
         },
         &quot;configSync&quot;: { # Configuration for Config Sync # Config Sync configuration for the cluster.
+          &quot;enabled&quot;: True or False, # Enables the installation of ConfigSync. If set to true, ConfigSync resources will be created and the other ConfigSync fields will be applied if exist. If set to false, all other ConfigSync fields will be ignored, ConfigSync resources will be deleted. If omitted, ConfigSync resources will be managed depends on the presence of git field.
           &quot;git&quot;: { # Git repo configuration for a single cluster. # Git repo configuration for the cluster.
             &quot;gcpServiceAccountEmail&quot;: &quot;A String&quot;, # The GCP Service Account Email used for auth when secret_type is gcpServiceAccount.
             &quot;httpsProxy&quot;: &quot;A String&quot;, # URL for the HTTPS proxy to be used when communicating with the Git repo.
-            &quot;noSslVerify&quot;: True or False, # Enable or disable the SSL certificate verification Default: false.
             &quot;policyDir&quot;: &quot;A String&quot;, # The path within the Git repository that represents the top level of the repo to sync. Default: the root directory of the repository.
             &quot;secretType&quot;: &quot;A String&quot;, # Type of secret configured for access to the Git repo.
             &quot;syncBranch&quot;: &quot;A String&quot;, # The branch of the repository to sync from. Default: master.
-            &quot;syncDepth&quot;: &quot;A String&quot;, # The depth of git commits synced by the git-sync container.
             &quot;syncRepo&quot;: &quot;A String&quot;, # The URL of the Git repository to use as the source of truth.
             &quot;syncRev&quot;: &quot;A String&quot;, # Git revision (tag or hash) to check out. Default HEAD.
             &quot;syncWaitSecs&quot;: &quot;A String&quot;, # Period in seconds between consecutive syncs. Default: 15.
           },
-          &quot;resourceRequirements&quot;: { # Specifies CPU and memory limits for containers, keyed by container name
-            &quot;a_key&quot;: { # ResourceRequirements allows to override the CPU and memory resource requirements of a container.
-              &quot;containerName&quot;: &quot;A String&quot;, # Name of the container
-              &quot;cpuLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the CPU limit of a container
-                &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-              },
-              &quot;memoryLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the memory limit of a container
-                &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-              },
-            },
-          },
           &quot;sourceFormat&quot;: &quot;A String&quot;, # Specifies whether the Config Sync Repo is in “hierarchical” or “unstructured” mode.
         },
         &quot;hierarchyController&quot;: { # Configuration for Hierarchy Controller # Hierarchy Controller configuration for the cluster.
@@ -269,29 +257,17 @@
             &quot;enabled&quot;: True or False, # Whether binauthz is enabled in this cluster.
           },
           &quot;configSync&quot;: { # Configuration for Config Sync # Config Sync configuration for the cluster.
+            &quot;enabled&quot;: True or False, # Enables the installation of ConfigSync. If set to true, ConfigSync resources will be created and the other ConfigSync fields will be applied if exist. If set to false, all other ConfigSync fields will be ignored, ConfigSync resources will be deleted. If omitted, ConfigSync resources will be managed depends on the presence of git field.
             &quot;git&quot;: { # Git repo configuration for a single cluster. # Git repo configuration for the cluster.
               &quot;gcpServiceAccountEmail&quot;: &quot;A String&quot;, # The GCP Service Account Email used for auth when secret_type is gcpServiceAccount.
               &quot;httpsProxy&quot;: &quot;A String&quot;, # URL for the HTTPS proxy to be used when communicating with the Git repo.
-              &quot;noSslVerify&quot;: True or False, # Enable or disable the SSL certificate verification Default: false.
               &quot;policyDir&quot;: &quot;A String&quot;, # The path within the Git repository that represents the top level of the repo to sync. Default: the root directory of the repository.
               &quot;secretType&quot;: &quot;A String&quot;, # Type of secret configured for access to the Git repo.
               &quot;syncBranch&quot;: &quot;A String&quot;, # The branch of the repository to sync from. Default: master.
-              &quot;syncDepth&quot;: &quot;A String&quot;, # The depth of git commits synced by the git-sync container.
               &quot;syncRepo&quot;: &quot;A String&quot;, # The URL of the Git repository to use as the source of truth.
               &quot;syncRev&quot;: &quot;A String&quot;, # Git revision (tag or hash) to check out. Default HEAD.
               &quot;syncWaitSecs&quot;: &quot;A String&quot;, # Period in seconds between consecutive syncs. Default: 15.
             },
-            &quot;resourceRequirements&quot;: { # Specifies CPU and memory limits for containers, keyed by container name
-              &quot;a_key&quot;: { # ResourceRequirements allows to override the CPU and memory resource requirements of a container.
-                &quot;containerName&quot;: &quot;A String&quot;, # Name of the container
-                &quot;cpuLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the CPU limit of a container
-                  &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-                },
-                &quot;memoryLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the memory limit of a container
-                  &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-                },
-              },
-            },
             &quot;sourceFormat&quot;: &quot;A String&quot;, # Specifies whether the Config Sync Repo is in “hierarchical” or “unstructured” mode.
           },
           &quot;hierarchyController&quot;: { # Configuration for Hierarchy Controller # Hierarchy Controller configuration for the cluster.
@@ -531,29 +507,17 @@
           &quot;enabled&quot;: True or False, # Whether binauthz is enabled in this cluster.
         },
         &quot;configSync&quot;: { # Configuration for Config Sync # Config Sync configuration for the cluster.
+          &quot;enabled&quot;: True or False, # Enables the installation of ConfigSync. If set to true, ConfigSync resources will be created and the other ConfigSync fields will be applied if exist. If set to false, all other ConfigSync fields will be ignored, ConfigSync resources will be deleted. If omitted, ConfigSync resources will be managed depends on the presence of git field.
           &quot;git&quot;: { # Git repo configuration for a single cluster. # Git repo configuration for the cluster.
             &quot;gcpServiceAccountEmail&quot;: &quot;A String&quot;, # The GCP Service Account Email used for auth when secret_type is gcpServiceAccount.
             &quot;httpsProxy&quot;: &quot;A String&quot;, # URL for the HTTPS proxy to be used when communicating with the Git repo.
-            &quot;noSslVerify&quot;: True or False, # Enable or disable the SSL certificate verification Default: false.
             &quot;policyDir&quot;: &quot;A String&quot;, # The path within the Git repository that represents the top level of the repo to sync. Default: the root directory of the repository.
             &quot;secretType&quot;: &quot;A String&quot;, # Type of secret configured for access to the Git repo.
             &quot;syncBranch&quot;: &quot;A String&quot;, # The branch of the repository to sync from. Default: master.
-            &quot;syncDepth&quot;: &quot;A String&quot;, # The depth of git commits synced by the git-sync container.
             &quot;syncRepo&quot;: &quot;A String&quot;, # The URL of the Git repository to use as the source of truth.
             &quot;syncRev&quot;: &quot;A String&quot;, # Git revision (tag or hash) to check out. Default HEAD.
             &quot;syncWaitSecs&quot;: &quot;A String&quot;, # Period in seconds between consecutive syncs. Default: 15.
           },
-          &quot;resourceRequirements&quot;: { # Specifies CPU and memory limits for containers, keyed by container name
-            &quot;a_key&quot;: { # ResourceRequirements allows to override the CPU and memory resource requirements of a container.
-              &quot;containerName&quot;: &quot;A String&quot;, # Name of the container
-              &quot;cpuLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the CPU limit of a container
-                &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-              },
-              &quot;memoryLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the memory limit of a container
-                &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-              },
-            },
-          },
           &quot;sourceFormat&quot;: &quot;A String&quot;, # Specifies whether the Config Sync Repo is in “hierarchical” or “unstructured” mode.
         },
         &quot;hierarchyController&quot;: { # Configuration for Hierarchy Controller # Hierarchy Controller configuration for the cluster.
@@ -668,29 +632,17 @@
             &quot;enabled&quot;: True or False, # Whether binauthz is enabled in this cluster.
           },
           &quot;configSync&quot;: { # Configuration for Config Sync # Config Sync configuration for the cluster.
+            &quot;enabled&quot;: True or False, # Enables the installation of ConfigSync. If set to true, ConfigSync resources will be created and the other ConfigSync fields will be applied if exist. If set to false, all other ConfigSync fields will be ignored, ConfigSync resources will be deleted. If omitted, ConfigSync resources will be managed depends on the presence of git field.
             &quot;git&quot;: { # Git repo configuration for a single cluster. # Git repo configuration for the cluster.
               &quot;gcpServiceAccountEmail&quot;: &quot;A String&quot;, # The GCP Service Account Email used for auth when secret_type is gcpServiceAccount.
               &quot;httpsProxy&quot;: &quot;A String&quot;, # URL for the HTTPS proxy to be used when communicating with the Git repo.
-              &quot;noSslVerify&quot;: True or False, # Enable or disable the SSL certificate verification Default: false.
               &quot;policyDir&quot;: &quot;A String&quot;, # The path within the Git repository that represents the top level of the repo to sync. Default: the root directory of the repository.
               &quot;secretType&quot;: &quot;A String&quot;, # Type of secret configured for access to the Git repo.
               &quot;syncBranch&quot;: &quot;A String&quot;, # The branch of the repository to sync from. Default: master.
-              &quot;syncDepth&quot;: &quot;A String&quot;, # The depth of git commits synced by the git-sync container.
               &quot;syncRepo&quot;: &quot;A String&quot;, # The URL of the Git repository to use as the source of truth.
               &quot;syncRev&quot;: &quot;A String&quot;, # Git revision (tag or hash) to check out. Default HEAD.
               &quot;syncWaitSecs&quot;: &quot;A String&quot;, # Period in seconds between consecutive syncs. Default: 15.
             },
-            &quot;resourceRequirements&quot;: { # Specifies CPU and memory limits for containers, keyed by container name
-              &quot;a_key&quot;: { # ResourceRequirements allows to override the CPU and memory resource requirements of a container.
-                &quot;containerName&quot;: &quot;A String&quot;, # Name of the container
-                &quot;cpuLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the CPU limit of a container
-                  &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-                },
-                &quot;memoryLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the memory limit of a container
-                  &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-                },
-              },
-            },
             &quot;sourceFormat&quot;: &quot;A String&quot;, # Specifies whether the Config Sync Repo is in “hierarchical” or “unstructured” mode.
           },
           &quot;hierarchyController&quot;: { # Configuration for Hierarchy Controller # Hierarchy Controller configuration for the cluster.
@@ -918,29 +870,17 @@
               &quot;enabled&quot;: True or False, # Whether binauthz is enabled in this cluster.
             },
             &quot;configSync&quot;: { # Configuration for Config Sync # Config Sync configuration for the cluster.
+              &quot;enabled&quot;: True or False, # Enables the installation of ConfigSync. If set to true, ConfigSync resources will be created and the other ConfigSync fields will be applied if exist. If set to false, all other ConfigSync fields will be ignored, ConfigSync resources will be deleted. If omitted, ConfigSync resources will be managed depends on the presence of git field.
               &quot;git&quot;: { # Git repo configuration for a single cluster. # Git repo configuration for the cluster.
                 &quot;gcpServiceAccountEmail&quot;: &quot;A String&quot;, # The GCP Service Account Email used for auth when secret_type is gcpServiceAccount.
                 &quot;httpsProxy&quot;: &quot;A String&quot;, # URL for the HTTPS proxy to be used when communicating with the Git repo.
-                &quot;noSslVerify&quot;: True or False, # Enable or disable the SSL certificate verification Default: false.
                 &quot;policyDir&quot;: &quot;A String&quot;, # The path within the Git repository that represents the top level of the repo to sync. Default: the root directory of the repository.
                 &quot;secretType&quot;: &quot;A String&quot;, # Type of secret configured for access to the Git repo.
                 &quot;syncBranch&quot;: &quot;A String&quot;, # The branch of the repository to sync from. Default: master.
-                &quot;syncDepth&quot;: &quot;A String&quot;, # The depth of git commits synced by the git-sync container.
                 &quot;syncRepo&quot;: &quot;A String&quot;, # The URL of the Git repository to use as the source of truth.
                 &quot;syncRev&quot;: &quot;A String&quot;, # Git revision (tag or hash) to check out. Default HEAD.
                 &quot;syncWaitSecs&quot;: &quot;A String&quot;, # Period in seconds between consecutive syncs. Default: 15.
               },
-              &quot;resourceRequirements&quot;: { # Specifies CPU and memory limits for containers, keyed by container name
-                &quot;a_key&quot;: { # ResourceRequirements allows to override the CPU and memory resource requirements of a container.
-                  &quot;containerName&quot;: &quot;A String&quot;, # Name of the container
-                  &quot;cpuLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the CPU limit of a container
-                    &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-                  },
-                  &quot;memoryLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the memory limit of a container
-                    &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-                  },
-                },
-              },
               &quot;sourceFormat&quot;: &quot;A String&quot;, # Specifies whether the Config Sync Repo is in “hierarchical” or “unstructured” mode.
             },
             &quot;hierarchyController&quot;: { # Configuration for Hierarchy Controller # Hierarchy Controller configuration for the cluster.
@@ -1055,29 +995,17 @@
                 &quot;enabled&quot;: True or False, # Whether binauthz is enabled in this cluster.
               },
               &quot;configSync&quot;: { # Configuration for Config Sync # Config Sync configuration for the cluster.
+                &quot;enabled&quot;: True or False, # Enables the installation of ConfigSync. If set to true, ConfigSync resources will be created and the other ConfigSync fields will be applied if exist. If set to false, all other ConfigSync fields will be ignored, ConfigSync resources will be deleted. If omitted, ConfigSync resources will be managed depends on the presence of git field.
                 &quot;git&quot;: { # Git repo configuration for a single cluster. # Git repo configuration for the cluster.
                   &quot;gcpServiceAccountEmail&quot;: &quot;A String&quot;, # The GCP Service Account Email used for auth when secret_type is gcpServiceAccount.
                   &quot;httpsProxy&quot;: &quot;A String&quot;, # URL for the HTTPS proxy to be used when communicating with the Git repo.
-                  &quot;noSslVerify&quot;: True or False, # Enable or disable the SSL certificate verification Default: false.
                   &quot;policyDir&quot;: &quot;A String&quot;, # The path within the Git repository that represents the top level of the repo to sync. Default: the root directory of the repository.
                   &quot;secretType&quot;: &quot;A String&quot;, # Type of secret configured for access to the Git repo.
                   &quot;syncBranch&quot;: &quot;A String&quot;, # The branch of the repository to sync from. Default: master.
-                  &quot;syncDepth&quot;: &quot;A String&quot;, # The depth of git commits synced by the git-sync container.
                   &quot;syncRepo&quot;: &quot;A String&quot;, # The URL of the Git repository to use as the source of truth.
                   &quot;syncRev&quot;: &quot;A String&quot;, # Git revision (tag or hash) to check out. Default HEAD.
                   &quot;syncWaitSecs&quot;: &quot;A String&quot;, # Period in seconds between consecutive syncs. Default: 15.
                 },
-                &quot;resourceRequirements&quot;: { # Specifies CPU and memory limits for containers, keyed by container name
-                  &quot;a_key&quot;: { # ResourceRequirements allows to override the CPU and memory resource requirements of a container.
-                    &quot;containerName&quot;: &quot;A String&quot;, # Name of the container
-                    &quot;cpuLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the CPU limit of a container
-                      &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-                    },
-                    &quot;memoryLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the memory limit of a container
-                      &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-                    },
-                  },
-                },
                 &quot;sourceFormat&quot;: &quot;A String&quot;, # Specifies whether the Config Sync Repo is in “hierarchical” or “unstructured” mode.
               },
               &quot;hierarchyController&quot;: { # Configuration for Hierarchy Controller # Hierarchy Controller configuration for the cluster.
@@ -1261,29 +1189,17 @@
           &quot;enabled&quot;: True or False, # Whether binauthz is enabled in this cluster.
         },
         &quot;configSync&quot;: { # Configuration for Config Sync # Config Sync configuration for the cluster.
+          &quot;enabled&quot;: True or False, # Enables the installation of ConfigSync. If set to true, ConfigSync resources will be created and the other ConfigSync fields will be applied if exist. If set to false, all other ConfigSync fields will be ignored, ConfigSync resources will be deleted. If omitted, ConfigSync resources will be managed depends on the presence of git field.
           &quot;git&quot;: { # Git repo configuration for a single cluster. # Git repo configuration for the cluster.
             &quot;gcpServiceAccountEmail&quot;: &quot;A String&quot;, # The GCP Service Account Email used for auth when secret_type is gcpServiceAccount.
             &quot;httpsProxy&quot;: &quot;A String&quot;, # URL for the HTTPS proxy to be used when communicating with the Git repo.
-            &quot;noSslVerify&quot;: True or False, # Enable or disable the SSL certificate verification Default: false.
             &quot;policyDir&quot;: &quot;A String&quot;, # The path within the Git repository that represents the top level of the repo to sync. Default: the root directory of the repository.
             &quot;secretType&quot;: &quot;A String&quot;, # Type of secret configured for access to the Git repo.
             &quot;syncBranch&quot;: &quot;A String&quot;, # The branch of the repository to sync from. Default: master.
-            &quot;syncDepth&quot;: &quot;A String&quot;, # The depth of git commits synced by the git-sync container.
             &quot;syncRepo&quot;: &quot;A String&quot;, # The URL of the Git repository to use as the source of truth.
             &quot;syncRev&quot;: &quot;A String&quot;, # Git revision (tag or hash) to check out. Default HEAD.
             &quot;syncWaitSecs&quot;: &quot;A String&quot;, # Period in seconds between consecutive syncs. Default: 15.
           },
-          &quot;resourceRequirements&quot;: { # Specifies CPU and memory limits for containers, keyed by container name
-            &quot;a_key&quot;: { # ResourceRequirements allows to override the CPU and memory resource requirements of a container.
-              &quot;containerName&quot;: &quot;A String&quot;, # Name of the container
-              &quot;cpuLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the CPU limit of a container
-                &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-              },
-              &quot;memoryLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the memory limit of a container
-                &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-              },
-            },
-          },
           &quot;sourceFormat&quot;: &quot;A String&quot;, # Specifies whether the Config Sync Repo is in “hierarchical” or “unstructured” mode.
         },
         &quot;hierarchyController&quot;: { # Configuration for Hierarchy Controller # Hierarchy Controller configuration for the cluster.
@@ -1398,29 +1314,17 @@
             &quot;enabled&quot;: True or False, # Whether binauthz is enabled in this cluster.
           },
           &quot;configSync&quot;: { # Configuration for Config Sync # Config Sync configuration for the cluster.
+            &quot;enabled&quot;: True or False, # Enables the installation of ConfigSync. If set to true, ConfigSync resources will be created and the other ConfigSync fields will be applied if exist. If set to false, all other ConfigSync fields will be ignored, ConfigSync resources will be deleted. If omitted, ConfigSync resources will be managed depends on the presence of git field.
             &quot;git&quot;: { # Git repo configuration for a single cluster. # Git repo configuration for the cluster.
               &quot;gcpServiceAccountEmail&quot;: &quot;A String&quot;, # The GCP Service Account Email used for auth when secret_type is gcpServiceAccount.
               &quot;httpsProxy&quot;: &quot;A String&quot;, # URL for the HTTPS proxy to be used when communicating with the Git repo.
-              &quot;noSslVerify&quot;: True or False, # Enable or disable the SSL certificate verification Default: false.
               &quot;policyDir&quot;: &quot;A String&quot;, # The path within the Git repository that represents the top level of the repo to sync. Default: the root directory of the repository.
               &quot;secretType&quot;: &quot;A String&quot;, # Type of secret configured for access to the Git repo.
               &quot;syncBranch&quot;: &quot;A String&quot;, # The branch of the repository to sync from. Default: master.
-              &quot;syncDepth&quot;: &quot;A String&quot;, # The depth of git commits synced by the git-sync container.
               &quot;syncRepo&quot;: &quot;A String&quot;, # The URL of the Git repository to use as the source of truth.
               &quot;syncRev&quot;: &quot;A String&quot;, # Git revision (tag or hash) to check out. Default HEAD.
               &quot;syncWaitSecs&quot;: &quot;A String&quot;, # Period in seconds between consecutive syncs. Default: 15.
             },
-            &quot;resourceRequirements&quot;: { # Specifies CPU and memory limits for containers, keyed by container name
-              &quot;a_key&quot;: { # ResourceRequirements allows to override the CPU and memory resource requirements of a container.
-                &quot;containerName&quot;: &quot;A String&quot;, # Name of the container
-                &quot;cpuLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the CPU limit of a container
-                  &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-                },
-                &quot;memoryLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the memory limit of a container
-                  &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-                },
-              },
-            },
             &quot;sourceFormat&quot;: &quot;A String&quot;, # Specifies whether the Config Sync Repo is in “hierarchical” or “unstructured” mode.
           },
           &quot;hierarchyController&quot;: { # Configuration for Hierarchy Controller # Hierarchy Controller configuration for the cluster.
diff --git a/docs/dyn/gkehub_v1alpha.projects.locations.memberships.html b/docs/dyn/gkehub_v1alpha.projects.locations.memberships.html
index 5f6383c..4a2094b 100644
--- a/docs/dyn/gkehub_v1alpha.projects.locations.memberships.html
+++ b/docs/dyn/gkehub_v1alpha.projects.locations.memberships.html
@@ -81,6 +81,12 @@
   <code><a href="#getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.</p>
 <p class="toc_element">
+  <code><a href="#listAdmin">listAdmin(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Lists Memberships of admin clusters in a given project and location. **This method is only used internally**.</p>
+<p class="toc_element">
+  <code><a href="#listAdmin_next">listAdmin_next(previous_request, previous_response)</a></code></p>
+<p class="firstline">Retrieves the next page of results.</p>
+<p class="toc_element">
   <code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.</p>
 <p class="toc_element">
@@ -141,6 +147,93 @@
 </div>
 
 <div class="method">
+    <code class="details" id="listAdmin">listAdmin(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, x__xgafv=None)</code>
+  <pre>Lists Memberships of admin clusters in a given project and location. **This method is only used internally**.
+
+Args:
+  parent: string, Required. The parent (project and location) where the Memberships of admin cluster will be listed. Specified in the format `projects/*/locations/*`. (required)
+  filter: string, Optional. Lists Memberships of admin clusters that match the filter expression.
+  orderBy: string, Optional. One or more fields to compare and use to sort the output. See https://google.aip.dev/132#ordering.
+  pageSize: integer, Optional. When requesting a &#x27;page&#x27; of resources, `page_size` specifies number of resources to return. If unspecified or set to 0, all resources will be returned.
+  pageToken: string, Optional. Token returned by previous call to `ListAdminClusterMemberships` which specifies the position in the list from where to continue listing the resources.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Response message for the `GkeHub.ListAdminClusterMemberships` method.
+  &quot;adminClusterMemberships&quot;: [ # The list of matching Memberships of admin clusters.
+    { # Membership contains information about a member cluster.
+      &quot;authority&quot;: { # Authority encodes how Google will recognize identities from this Membership. See the workload identity documentation for more details: https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity # Optional. How to identify workloads from this Membership. See the documentation on Workload Identity for more details: https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity
+        &quot;identityProvider&quot;: &quot;A String&quot;, # Output only. An identity provider that reflects the `issuer` in the workload identity pool.
+        &quot;issuer&quot;: &quot;A String&quot;, # Optional. A JSON Web Token (JWT) issuer URI. `issuer` must start with `https://` and be a valid URL with length &lt;2000 characters. If set, then Google will allow valid OIDC tokens from this issuer to authenticate within the workload_identity_pool. OIDC discovery will be performed on this URI to validate tokens from the issuer. Clearing `issuer` disables Workload Identity. `issuer` cannot be directly modified; it must be cleared (and Workload Identity disabled) before using a new issuer (and re-enabling Workload Identity).
+        &quot;oidcJwks&quot;: &quot;A String&quot;, # Optional. OIDC verification keys for this Membership in JWKS format (RFC 7517). When this field is set, OIDC discovery will NOT be performed on `issuer`, and instead OIDC tokens will be validated using this field.
+        &quot;workloadIdentityPool&quot;: &quot;A String&quot;, # Output only. The name of the workload identity pool in which `issuer` will be recognized. There is a single Workload Identity Pool per Hub that is shared between all Memberships that belong to that Hub. For a Hub hosted in {PROJECT_ID}, the workload pool format is `{PROJECT_ID}.hub.id.goog`, although this is subject to change in newer versions of this API.
+      },
+      &quot;createTime&quot;: &quot;A String&quot;, # Output only. When the Membership was created.
+      &quot;deleteTime&quot;: &quot;A String&quot;, # Output only. When the Membership was deleted.
+      &quot;description&quot;: &quot;A String&quot;, # Output only. Description of this membership, limited to 63 characters. Must match the regex: `a-zA-Z0-9*` This field is present for legacy purposes.
+      &quot;endpoint&quot;: { # MembershipEndpoint contains information needed to contact a Kubernetes API, endpoint and any additional Kubernetes metadata. # Optional. Endpoint information to reach this member.
+        &quot;gkeCluster&quot;: { # GkeCluster contains information specific to GKE clusters. # Optional. Specific information for a GKE-on-GCP cluster.
+          &quot;clusterMissing&quot;: True or False, # Output only. If cluster_missing is set then it denotes that the GKE cluster no longer exists in the GKE Control Plane.
+          &quot;resourceLink&quot;: &quot;A String&quot;, # Immutable. Self-link of the GCP resource for the GKE cluster. For example: //container.googleapis.com/projects/my-project/locations/us-west1-a/clusters/my-cluster Zonal clusters are also supported.
+        },
+        &quot;kubernetesMetadata&quot;: { # KubernetesMetadata provides informational metadata for Memberships representing Kubernetes clusters. # Output only. Useful Kubernetes-specific metadata.
+          &quot;kubernetesApiServerVersion&quot;: &quot;A String&quot;, # Output only. Kubernetes API server version string as reported by `/version`.
+          &quot;memoryMb&quot;: 42, # Output only. The total memory capacity as reported by the sum of all Kubernetes nodes resources, defined in MB.
+          &quot;nodeCount&quot;: 42, # Output only. Node count as reported by Kubernetes nodes resources.
+          &quot;nodeProviderId&quot;: &quot;A String&quot;, # Output only. Node providerID as reported by the first node in the list of nodes on the Kubernetes endpoint. On Kubernetes platforms that support zero-node clusters (like GKE-on-GCP), the node_count will be zero and the node_provider_id will be empty.
+          &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time at which these details were last updated. This update_time is different from the Membership-level update_time since EndpointDetails are updated internally for API consumers.
+          &quot;vcpuCount&quot;: 42, # Output only. vCPU count as reported by Kubernetes nodes resources.
+        },
+        &quot;multiCloudCluster&quot;: { # MultiCloudCluster contains information specific to GKE Multi-Cloud clusters. # Optional. Specific information for a GKE Multi-Cloud cluster.
+          &quot;clusterMissing&quot;: True or False, # Output only. If cluster_missing is set then it denotes that API(gkemulticloud.googleapis.com) resource for this GKE Multi-Cloud cluster no longer exists.
+          &quot;resourceLink&quot;: &quot;A String&quot;, # Immutable. Self-link of the GCP resource for the GKE Multi-Cloud cluster. For example: //gkemulticloud.googleapis.com/projects/my-project/locations/us-west1-a/awsClusters/my-cluster //gkemulticloud.googleapis.com/projects/my-project/locations/us-west1-a/azureClusters/my-cluster
+        },
+        &quot;onPremCluster&quot;: { # OnPremCluster contains information specific to GKE On-Prem clusters. # Optional. Specific information for a GKE On-Prem cluster.
+          &quot;adminCluster&quot;: True or False, # Immutable. Whether the cluster is an admin cluster.
+          &quot;clusterMissing&quot;: True or False, # Output only. If cluster_missing is set then it denotes that API(gkeonprem.googleapis.com) resource for this GKE On-Prem cluster no longer exists.
+          &quot;resourceLink&quot;: &quot;A String&quot;, # Immutable. Self-link of the GCP resource for the GKE On-Prem cluster. For example: //gkeonprem.googleapis.com/projects/my-project/locations/us-west1-a/vmwareClusters/my-cluster //gkeonprem.googleapis.com/projects/my-project/locations/us-west1-a/bareMetalClusters/my-cluster
+        },
+      },
+      &quot;externalId&quot;: &quot;A String&quot;, # Optional. An externally-generated and managed ID for this Membership. This ID may be modified after creation, but this is not recommended. The ID must match the regex: `a-zA-Z0-9*` If this Membership represents a Kubernetes cluster, this value should be set to the UID of the `kube-system` namespace object.
+      &quot;labels&quot;: { # Optional. GCP labels for this membership.
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+      &quot;lastConnectionTime&quot;: &quot;A String&quot;, # Output only. For clusters using Connect, the timestamp of the most recent connection established with Google Cloud. This time is updated every several minutes, not continuously. For clusters that do not use GKE Connect, or that have never connected successfully, this field will be unset.
+      &quot;name&quot;: &quot;A String&quot;, # Output only. The full, unique name of this Membership resource in the format `projects/*/locations/*/memberships/{membership_id}`, set during creation. `membership_id` must be a valid RFC 1123 compliant DNS label: 1. At most 63 characters in length 2. It must consist of lower case alphanumeric characters or `-` 3. It must start and end with an alphanumeric character Which can be expressed as the regex: `[a-z0-9]([-a-z0-9]*[a-z0-9])?`, with a maximum length of 63 characters.
+      &quot;state&quot;: { # MembershipState describes the state of a Membership resource. # Output only. State of the Membership resource.
+        &quot;code&quot;: &quot;A String&quot;, # Output only. The current state of the Membership resource.
+      },
+      &quot;uniqueId&quot;: &quot;A String&quot;, # Output only. Google-generated UUID for this resource. This is unique across all Membership resources. If a Membership resource is deleted and another resource with the same name is created, it gets a different unique_id.
+      &quot;updateTime&quot;: &quot;A String&quot;, # Output only. When the Membership was last updated.
+    },
+  ],
+  &quot;nextPageToken&quot;: &quot;A String&quot;, # A token to request the next page of resources from the `ListAdminClusterMemberships` method. The value of an empty string means that there are no more resources to return.
+  &quot;unreachable&quot;: [ # List of locations that could not be reached while fetching this list.
+    &quot;A String&quot;,
+  ],
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="listAdmin_next">listAdmin_next(previous_request, previous_response)</code>
+  <pre>Retrieves the next page of results.
+
+Args:
+  previous_request: The request for the previous page. (required)
+  previous_response: The response from the request for the previous page. (required)
+
+Returns:
+  A request object that you can call &#x27;execute()&#x27; on to request the next
+  page. Returns None if there are no more items in the collection.
+    </pre>
+</div>
+
+<div class="method">
     <code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>
   <pre>Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.
 
diff --git a/docs/dyn/gkehub_v1beta.projects.locations.features.html b/docs/dyn/gkehub_v1beta.projects.locations.features.html
index 73fe647..f399d8a 100644
--- a/docs/dyn/gkehub_v1beta.projects.locations.features.html
+++ b/docs/dyn/gkehub_v1beta.projects.locations.features.html
@@ -135,26 +135,13 @@
           &quot;git&quot;: { # Git repo configuration for a single cluster. # Git repo configuration for the cluster.
             &quot;gcpServiceAccountEmail&quot;: &quot;A String&quot;, # The GCP Service Account Email used for auth when secret_type is gcpServiceAccount.
             &quot;httpsProxy&quot;: &quot;A String&quot;, # URL for the HTTPS proxy to be used when communicating with the Git repo.
-            &quot;noSslVerify&quot;: True or False, # Enable or disable the SSL certificate verification Default: false.
             &quot;policyDir&quot;: &quot;A String&quot;, # The path within the Git repository that represents the top level of the repo to sync. Default: the root directory of the repository.
             &quot;secretType&quot;: &quot;A String&quot;, # Type of secret configured for access to the Git repo.
             &quot;syncBranch&quot;: &quot;A String&quot;, # The branch of the repository to sync from. Default: master.
-            &quot;syncDepth&quot;: &quot;A String&quot;, # The depth of git commits synced by the git-sync container.
             &quot;syncRepo&quot;: &quot;A String&quot;, # The URL of the Git repository to use as the source of truth.
             &quot;syncRev&quot;: &quot;A String&quot;, # Git revision (tag or hash) to check out. Default HEAD.
             &quot;syncWaitSecs&quot;: &quot;A String&quot;, # Period in seconds between consecutive syncs. Default: 15.
           },
-          &quot;resourceRequirements&quot;: { # Specifies CPU and memory limits for containers, keyed by container name
-            &quot;a_key&quot;: { # ResourceRequirements allows to override the CPU and memory resource requirements of a container.
-              &quot;containerName&quot;: &quot;A String&quot;, # Name of the container
-              &quot;cpuLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the CPU limit of a container
-                &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-              },
-              &quot;memoryLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the memory limit of a container
-                &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-              },
-            },
-          },
           &quot;sourceFormat&quot;: &quot;A String&quot;, # Specifies whether the Config Sync Repo is in “hierarchical” or “unstructured” mode.
         },
         &quot;hierarchyController&quot;: { # Configuration for Hierarchy Controller # Hierarchy Controller configuration for the cluster.
@@ -271,26 +258,13 @@
             &quot;git&quot;: { # Git repo configuration for a single cluster. # Git repo configuration for the cluster.
               &quot;gcpServiceAccountEmail&quot;: &quot;A String&quot;, # The GCP Service Account Email used for auth when secret_type is gcpServiceAccount.
               &quot;httpsProxy&quot;: &quot;A String&quot;, # URL for the HTTPS proxy to be used when communicating with the Git repo.
-              &quot;noSslVerify&quot;: True or False, # Enable or disable the SSL certificate verification Default: false.
               &quot;policyDir&quot;: &quot;A String&quot;, # The path within the Git repository that represents the top level of the repo to sync. Default: the root directory of the repository.
               &quot;secretType&quot;: &quot;A String&quot;, # Type of secret configured for access to the Git repo.
               &quot;syncBranch&quot;: &quot;A String&quot;, # The branch of the repository to sync from. Default: master.
-              &quot;syncDepth&quot;: &quot;A String&quot;, # The depth of git commits synced by the git-sync container.
               &quot;syncRepo&quot;: &quot;A String&quot;, # The URL of the Git repository to use as the source of truth.
               &quot;syncRev&quot;: &quot;A String&quot;, # Git revision (tag or hash) to check out. Default HEAD.
               &quot;syncWaitSecs&quot;: &quot;A String&quot;, # Period in seconds between consecutive syncs. Default: 15.
             },
-            &quot;resourceRequirements&quot;: { # Specifies CPU and memory limits for containers, keyed by container name
-              &quot;a_key&quot;: { # ResourceRequirements allows to override the CPU and memory resource requirements of a container.
-                &quot;containerName&quot;: &quot;A String&quot;, # Name of the container
-                &quot;cpuLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the CPU limit of a container
-                  &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-                },
-                &quot;memoryLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the memory limit of a container
-                  &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-                },
-              },
-            },
             &quot;sourceFormat&quot;: &quot;A String&quot;, # Specifies whether the Config Sync Repo is in “hierarchical” or “unstructured” mode.
           },
           &quot;hierarchyController&quot;: { # Configuration for Hierarchy Controller # Hierarchy Controller configuration for the cluster.
@@ -484,26 +458,13 @@
           &quot;git&quot;: { # Git repo configuration for a single cluster. # Git repo configuration for the cluster.
             &quot;gcpServiceAccountEmail&quot;: &quot;A String&quot;, # The GCP Service Account Email used for auth when secret_type is gcpServiceAccount.
             &quot;httpsProxy&quot;: &quot;A String&quot;, # URL for the HTTPS proxy to be used when communicating with the Git repo.
-            &quot;noSslVerify&quot;: True or False, # Enable or disable the SSL certificate verification Default: false.
             &quot;policyDir&quot;: &quot;A String&quot;, # The path within the Git repository that represents the top level of the repo to sync. Default: the root directory of the repository.
             &quot;secretType&quot;: &quot;A String&quot;, # Type of secret configured for access to the Git repo.
             &quot;syncBranch&quot;: &quot;A String&quot;, # The branch of the repository to sync from. Default: master.
-            &quot;syncDepth&quot;: &quot;A String&quot;, # The depth of git commits synced by the git-sync container.
             &quot;syncRepo&quot;: &quot;A String&quot;, # The URL of the Git repository to use as the source of truth.
             &quot;syncRev&quot;: &quot;A String&quot;, # Git revision (tag or hash) to check out. Default HEAD.
             &quot;syncWaitSecs&quot;: &quot;A String&quot;, # Period in seconds between consecutive syncs. Default: 15.
           },
-          &quot;resourceRequirements&quot;: { # Specifies CPU and memory limits for containers, keyed by container name
-            &quot;a_key&quot;: { # ResourceRequirements allows to override the CPU and memory resource requirements of a container.
-              &quot;containerName&quot;: &quot;A String&quot;, # Name of the container
-              &quot;cpuLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the CPU limit of a container
-                &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-              },
-              &quot;memoryLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the memory limit of a container
-                &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-              },
-            },
-          },
           &quot;sourceFormat&quot;: &quot;A String&quot;, # Specifies whether the Config Sync Repo is in “hierarchical” or “unstructured” mode.
         },
         &quot;hierarchyController&quot;: { # Configuration for Hierarchy Controller # Hierarchy Controller configuration for the cluster.
@@ -620,26 +581,13 @@
             &quot;git&quot;: { # Git repo configuration for a single cluster. # Git repo configuration for the cluster.
               &quot;gcpServiceAccountEmail&quot;: &quot;A String&quot;, # The GCP Service Account Email used for auth when secret_type is gcpServiceAccount.
               &quot;httpsProxy&quot;: &quot;A String&quot;, # URL for the HTTPS proxy to be used when communicating with the Git repo.
-              &quot;noSslVerify&quot;: True or False, # Enable or disable the SSL certificate verification Default: false.
               &quot;policyDir&quot;: &quot;A String&quot;, # The path within the Git repository that represents the top level of the repo to sync. Default: the root directory of the repository.
               &quot;secretType&quot;: &quot;A String&quot;, # Type of secret configured for access to the Git repo.
               &quot;syncBranch&quot;: &quot;A String&quot;, # The branch of the repository to sync from. Default: master.
-              &quot;syncDepth&quot;: &quot;A String&quot;, # The depth of git commits synced by the git-sync container.
               &quot;syncRepo&quot;: &quot;A String&quot;, # The URL of the Git repository to use as the source of truth.
               &quot;syncRev&quot;: &quot;A String&quot;, # Git revision (tag or hash) to check out. Default HEAD.
               &quot;syncWaitSecs&quot;: &quot;A String&quot;, # Period in seconds between consecutive syncs. Default: 15.
             },
-            &quot;resourceRequirements&quot;: { # Specifies CPU and memory limits for containers, keyed by container name
-              &quot;a_key&quot;: { # ResourceRequirements allows to override the CPU and memory resource requirements of a container.
-                &quot;containerName&quot;: &quot;A String&quot;, # Name of the container
-                &quot;cpuLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the CPU limit of a container
-                  &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-                },
-                &quot;memoryLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the memory limit of a container
-                  &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-                },
-              },
-            },
             &quot;sourceFormat&quot;: &quot;A String&quot;, # Specifies whether the Config Sync Repo is in “hierarchical” or “unstructured” mode.
           },
           &quot;hierarchyController&quot;: { # Configuration for Hierarchy Controller # Hierarchy Controller configuration for the cluster.
@@ -821,26 +769,13 @@
               &quot;git&quot;: { # Git repo configuration for a single cluster. # Git repo configuration for the cluster.
                 &quot;gcpServiceAccountEmail&quot;: &quot;A String&quot;, # The GCP Service Account Email used for auth when secret_type is gcpServiceAccount.
                 &quot;httpsProxy&quot;: &quot;A String&quot;, # URL for the HTTPS proxy to be used when communicating with the Git repo.
-                &quot;noSslVerify&quot;: True or False, # Enable or disable the SSL certificate verification Default: false.
                 &quot;policyDir&quot;: &quot;A String&quot;, # The path within the Git repository that represents the top level of the repo to sync. Default: the root directory of the repository.
                 &quot;secretType&quot;: &quot;A String&quot;, # Type of secret configured for access to the Git repo.
                 &quot;syncBranch&quot;: &quot;A String&quot;, # The branch of the repository to sync from. Default: master.
-                &quot;syncDepth&quot;: &quot;A String&quot;, # The depth of git commits synced by the git-sync container.
                 &quot;syncRepo&quot;: &quot;A String&quot;, # The URL of the Git repository to use as the source of truth.
                 &quot;syncRev&quot;: &quot;A String&quot;, # Git revision (tag or hash) to check out. Default HEAD.
                 &quot;syncWaitSecs&quot;: &quot;A String&quot;, # Period in seconds between consecutive syncs. Default: 15.
               },
-              &quot;resourceRequirements&quot;: { # Specifies CPU and memory limits for containers, keyed by container name
-                &quot;a_key&quot;: { # ResourceRequirements allows to override the CPU and memory resource requirements of a container.
-                  &quot;containerName&quot;: &quot;A String&quot;, # Name of the container
-                  &quot;cpuLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the CPU limit of a container
-                    &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-                  },
-                  &quot;memoryLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the memory limit of a container
-                    &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-                  },
-                },
-              },
               &quot;sourceFormat&quot;: &quot;A String&quot;, # Specifies whether the Config Sync Repo is in “hierarchical” or “unstructured” mode.
             },
             &quot;hierarchyController&quot;: { # Configuration for Hierarchy Controller # Hierarchy Controller configuration for the cluster.
@@ -957,26 +892,13 @@
                 &quot;git&quot;: { # Git repo configuration for a single cluster. # Git repo configuration for the cluster.
                   &quot;gcpServiceAccountEmail&quot;: &quot;A String&quot;, # The GCP Service Account Email used for auth when secret_type is gcpServiceAccount.
                   &quot;httpsProxy&quot;: &quot;A String&quot;, # URL for the HTTPS proxy to be used when communicating with the Git repo.
-                  &quot;noSslVerify&quot;: True or False, # Enable or disable the SSL certificate verification Default: false.
                   &quot;policyDir&quot;: &quot;A String&quot;, # The path within the Git repository that represents the top level of the repo to sync. Default: the root directory of the repository.
                   &quot;secretType&quot;: &quot;A String&quot;, # Type of secret configured for access to the Git repo.
                   &quot;syncBranch&quot;: &quot;A String&quot;, # The branch of the repository to sync from. Default: master.
-                  &quot;syncDepth&quot;: &quot;A String&quot;, # The depth of git commits synced by the git-sync container.
                   &quot;syncRepo&quot;: &quot;A String&quot;, # The URL of the Git repository to use as the source of truth.
                   &quot;syncRev&quot;: &quot;A String&quot;, # Git revision (tag or hash) to check out. Default HEAD.
                   &quot;syncWaitSecs&quot;: &quot;A String&quot;, # Period in seconds between consecutive syncs. Default: 15.
                 },
-                &quot;resourceRequirements&quot;: { # Specifies CPU and memory limits for containers, keyed by container name
-                  &quot;a_key&quot;: { # ResourceRequirements allows to override the CPU and memory resource requirements of a container.
-                    &quot;containerName&quot;: &quot;A String&quot;, # Name of the container
-                    &quot;cpuLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the CPU limit of a container
-                      &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-                    },
-                    &quot;memoryLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the memory limit of a container
-                      &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-                    },
-                  },
-                },
                 &quot;sourceFormat&quot;: &quot;A String&quot;, # Specifies whether the Config Sync Repo is in “hierarchical” or “unstructured” mode.
               },
               &quot;hierarchyController&quot;: { # Configuration for Hierarchy Controller # Hierarchy Controller configuration for the cluster.
@@ -1114,26 +1036,13 @@
           &quot;git&quot;: { # Git repo configuration for a single cluster. # Git repo configuration for the cluster.
             &quot;gcpServiceAccountEmail&quot;: &quot;A String&quot;, # The GCP Service Account Email used for auth when secret_type is gcpServiceAccount.
             &quot;httpsProxy&quot;: &quot;A String&quot;, # URL for the HTTPS proxy to be used when communicating with the Git repo.
-            &quot;noSslVerify&quot;: True or False, # Enable or disable the SSL certificate verification Default: false.
             &quot;policyDir&quot;: &quot;A String&quot;, # The path within the Git repository that represents the top level of the repo to sync. Default: the root directory of the repository.
             &quot;secretType&quot;: &quot;A String&quot;, # Type of secret configured for access to the Git repo.
             &quot;syncBranch&quot;: &quot;A String&quot;, # The branch of the repository to sync from. Default: master.
-            &quot;syncDepth&quot;: &quot;A String&quot;, # The depth of git commits synced by the git-sync container.
             &quot;syncRepo&quot;: &quot;A String&quot;, # The URL of the Git repository to use as the source of truth.
             &quot;syncRev&quot;: &quot;A String&quot;, # Git revision (tag or hash) to check out. Default HEAD.
             &quot;syncWaitSecs&quot;: &quot;A String&quot;, # Period in seconds between consecutive syncs. Default: 15.
           },
-          &quot;resourceRequirements&quot;: { # Specifies CPU and memory limits for containers, keyed by container name
-            &quot;a_key&quot;: { # ResourceRequirements allows to override the CPU and memory resource requirements of a container.
-              &quot;containerName&quot;: &quot;A String&quot;, # Name of the container
-              &quot;cpuLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the CPU limit of a container
-                &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-              },
-              &quot;memoryLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the memory limit of a container
-                &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-              },
-            },
-          },
           &quot;sourceFormat&quot;: &quot;A String&quot;, # Specifies whether the Config Sync Repo is in “hierarchical” or “unstructured” mode.
         },
         &quot;hierarchyController&quot;: { # Configuration for Hierarchy Controller # Hierarchy Controller configuration for the cluster.
@@ -1250,26 +1159,13 @@
             &quot;git&quot;: { # Git repo configuration for a single cluster. # Git repo configuration for the cluster.
               &quot;gcpServiceAccountEmail&quot;: &quot;A String&quot;, # The GCP Service Account Email used for auth when secret_type is gcpServiceAccount.
               &quot;httpsProxy&quot;: &quot;A String&quot;, # URL for the HTTPS proxy to be used when communicating with the Git repo.
-              &quot;noSslVerify&quot;: True or False, # Enable or disable the SSL certificate verification Default: false.
               &quot;policyDir&quot;: &quot;A String&quot;, # The path within the Git repository that represents the top level of the repo to sync. Default: the root directory of the repository.
               &quot;secretType&quot;: &quot;A String&quot;, # Type of secret configured for access to the Git repo.
               &quot;syncBranch&quot;: &quot;A String&quot;, # The branch of the repository to sync from. Default: master.
-              &quot;syncDepth&quot;: &quot;A String&quot;, # The depth of git commits synced by the git-sync container.
               &quot;syncRepo&quot;: &quot;A String&quot;, # The URL of the Git repository to use as the source of truth.
               &quot;syncRev&quot;: &quot;A String&quot;, # Git revision (tag or hash) to check out. Default HEAD.
               &quot;syncWaitSecs&quot;: &quot;A String&quot;, # Period in seconds between consecutive syncs. Default: 15.
             },
-            &quot;resourceRequirements&quot;: { # Specifies CPU and memory limits for containers, keyed by container name
-              &quot;a_key&quot;: { # ResourceRequirements allows to override the CPU and memory resource requirements of a container.
-                &quot;containerName&quot;: &quot;A String&quot;, # Name of the container
-                &quot;cpuLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the CPU limit of a container
-                  &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-                },
-                &quot;memoryLimit&quot;: { # The view model of a single quantity, e.g. &quot;800 MiB&quot;. Corresponds to https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/generated.proto # Allows to override the memory limit of a container
-                  &quot;string&quot;: &quot;A String&quot;, # Stringified version of the quantity, e.g., &quot;800 MiB&quot;.
-                },
-              },
-            },
             &quot;sourceFormat&quot;: &quot;A String&quot;, # Specifies whether the Config Sync Repo is in “hierarchical” or “unstructured” mode.
           },
           &quot;hierarchyController&quot;: { # Configuration for Hierarchy Controller # Hierarchy Controller configuration for the cluster.
diff --git a/docs/dyn/healthcare_v1.projects.locations.datasets.hl7V2Stores.html b/docs/dyn/healthcare_v1.projects.locations.datasets.hl7V2Stores.html
index 0356a68..6a04012 100644
--- a/docs/dyn/healthcare_v1.projects.locations.datasets.hl7V2Stores.html
+++ b/docs/dyn/healthcare_v1.projects.locations.datasets.hl7V2Stores.html
@@ -89,12 +89,18 @@
   <code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>
 <p class="firstline">Deletes the specified HL7v2 store and removes all messages that it contains.</p>
 <p class="toc_element">
+  <code><a href="#export">export(name, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Exports the messages to a destination. To filter messages to be exported, define a filter using the start and end time, relative to the message generation time (MSH.7). This API returns an Operation that can be used to track the status of the job by calling GetOperation. Immediate fatal errors appear in the error field. Otherwise, when the operation finishes, a detailed response of type ExportMessagesResponse is returned in the response field. The metadata field type for this operation is OperationMetadata.</p>
+<p class="toc_element">
   <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
 <p class="firstline">Gets the specified HL7v2 store.</p>
 <p class="toc_element">
   <code><a href="#getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.</p>
 <p class="toc_element">
+  <code><a href="#import_">import_(name, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Import messages to the HL7v2 store by loading data from the specified sources. This method is optimized to load large quantities of data using import semantics that ignore some HL7v2 store configuration options and are not suitable for all use cases. It is primarily intended to load data into an empty HL7v2 store that is not being used by other clients. An existing message will be overwritten if a duplicate message is imported. A duplicate message is a message with the same raw bytes as a message that already exists in this HL7v2 store. When a message is overwritten, its labels will also be overwritten. The import operation is idempotent unless the input data contains multiple valid messages with the same raw bytes but different labels. In that case, after the import completes, the store contains exactly one message with those raw bytes but there is no ordering guarantee on which version of the labels it has. The operation result counters do not count duplicated raw bytes as an error and count one success for each message in the input, which might result in a success count larger than the number of messages in the HL7v2 store. If some messages fail to import, for example due to parsing errors, successfully imported messages are not rolled back. This method returns an Operation that can be used to track the status of the import by calling GetOperation. Immediate fatal errors appear in the error field, errors are also logged to Cloud Logging (see [Viewing error logs in Cloud Logging](https://cloud.google.com/healthcare/docs/how-tos/logging)). Otherwise, when the operation finishes, a response of type ImportMessagesResponse is returned in the response field. The metadata field type for this operation is OperationMetadata.</p>
+<p class="toc_element">
   <code><a href="#list">list(parent, filter=None, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Lists the HL7v2 stores in the given dataset.</p>
 <p class="toc_element">
@@ -307,6 +313,54 @@
 </div>
 
 <div class="method">
+    <code class="details" id="export">export(name, body=None, x__xgafv=None)</code>
+  <pre>Exports the messages to a destination. To filter messages to be exported, define a filter using the start and end time, relative to the message generation time (MSH.7). This API returns an Operation that can be used to track the status of the job by calling GetOperation. Immediate fatal errors appear in the error field. Otherwise, when the operation finishes, a detailed response of type ExportMessagesResponse is returned in the response field. The metadata field type for this operation is OperationMetadata.
+
+Args:
+  name: string, The name of the source HL7v2 store, in the format `projects/{project_id}/locations/{location_id}/datasets/{dataset_id}/hl7v2Stores/{hl7v2_store_id}` (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Request to schedule an export.
+  &quot;endTime&quot;: &quot;A String&quot;, # The end of the range in `send_time` (MSH.7, https://www.hl7.org/documentcenter/public_temp_2E58C1F9-1C23-BA17-0C6126475344DA9D/wg/conf/HL7MSH.htm) to process. If not specified, the time when the export is scheduled is used. This value has to come after the `start_time` defined below. Only messages whose `send_time` lies in the range `start_time` (inclusive) to `end_time` (exclusive) are exported.
+  &quot;gcsDestination&quot;: { # The Cloud Storage output destination. The Cloud Healthcare Service Agent requires the `roles/storage.objectAdmin` Cloud IAM roles on the Cloud Storage location. # Export to a Cloud Storage destination.
+    &quot;contentStructure&quot;: &quot;A String&quot;, # The format of the exported HL7v2 message files.
+    &quot;messageView&quot;: &quot;A String&quot;, # Specifies the parts of the Message resource to include in the export. If not specified, FULL is used.
+    &quot;uriPrefix&quot;: &quot;A String&quot;, # URI of an existing Cloud Storage directory where the server writes result files, in the format `gs://{bucket-id}/{path/to/destination/dir}`. If there is no trailing slash, the service appends one when composing the object path.
+  },
+  &quot;startTime&quot;: &quot;A String&quot;, # The start of the range in `send_time` (MSH.7, https://www.hl7.org/documentcenter/public_temp_2E58C1F9-1C23-BA17-0C6126475344DA9D/wg/conf/HL7MSH.htm) to process. If not specified, the UNIX epoch (1970-01-01T00:00:00Z) is used. This value has to come before the `end_time` defined below. Only messages whose `send_time` lies in the range `start_time` (inclusive) to `end_time` (exclusive) are exported.
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # This resource represents a long-running operation that is the result of a network API call.
+  &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+  &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+    &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+      {
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    ],
+    &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+  },
+  &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+  &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+}</pre>
+</div>
+
+<div class="method">
     <code class="details" id="get">get(name, x__xgafv=None)</code>
   <pre>Gets the specified HL7v2 store.
 
@@ -447,6 +501,50 @@
 </div>
 
 <div class="method">
+    <code class="details" id="import_">import_(name, body=None, x__xgafv=None)</code>
+  <pre>Import messages to the HL7v2 store by loading data from the specified sources. This method is optimized to load large quantities of data using import semantics that ignore some HL7v2 store configuration options and are not suitable for all use cases. It is primarily intended to load data into an empty HL7v2 store that is not being used by other clients. An existing message will be overwritten if a duplicate message is imported. A duplicate message is a message with the same raw bytes as a message that already exists in this HL7v2 store. When a message is overwritten, its labels will also be overwritten. The import operation is idempotent unless the input data contains multiple valid messages with the same raw bytes but different labels. In that case, after the import completes, the store contains exactly one message with those raw bytes but there is no ordering guarantee on which version of the labels it has. The operation result counters do not count duplicated raw bytes as an error and count one success for each message in the input, which might result in a success count larger than the number of messages in the HL7v2 store. If some messages fail to import, for example due to parsing errors, successfully imported messages are not rolled back. This method returns an Operation that can be used to track the status of the import by calling GetOperation. Immediate fatal errors appear in the error field, errors are also logged to Cloud Logging (see [Viewing error logs in Cloud Logging](https://cloud.google.com/healthcare/docs/how-tos/logging)). Otherwise, when the operation finishes, a response of type ImportMessagesResponse is returned in the response field. The metadata field type for this operation is OperationMetadata.
+
+Args:
+  name: string, The name of the target HL7v2 store, in the format `projects/{project_id}/locations/{location_id}/datasets/{dataset_id}/hl7v2Stores/{hl7v2_store_id}` (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Request to import messages.
+  &quot;gcsSource&quot;: { # Specifies the configuration for importing data from Cloud Storage. # Cloud Storage source data location and import configuration. The Cloud Healthcare Service Agent requires the `roles/storage.objectViewer` Cloud IAM roles on the Cloud Storage location.
+    &quot;uri&quot;: &quot;A String&quot;, # Points to a Cloud Storage URI containing file(s) to import. The URI must be in the following format: `gs://{bucket_id}/{object_id}`. The URI can include wildcards in `object_id` and thus identify multiple files. Supported wildcards: * `*` to match 0 or more non-separator characters * `**` to match 0 or more characters (including separators). Must be used at the end of a path and with no other wildcards in the path. Can also be used with a file extension (such as .ndjson), which imports all files with the extension in the specified directory and its sub-directories. For example, `gs://my-bucket/my-directory/**.ndjson` imports all files with `.ndjson` extensions in `my-directory/` and its sub-directories. * `?` to match 1 character Files matching the wildcard are expected to contain content only, no metadata.
+  },
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # This resource represents a long-running operation that is the result of a network API call.
+  &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+  &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+    &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+      {
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    ],
+    &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+  },
+  &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+  &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+}</pre>
+</div>
+
+<div class="method">
     <code class="details" id="list">list(parent, filter=None, pageSize=None, pageToken=None, x__xgafv=None)</code>
   <pre>Lists the HL7v2 stores in the given dataset.
 
diff --git a/docs/dyn/index.md b/docs/dyn/index.md
index 183d967..8b958ea 100644
--- a/docs/dyn/index.md
+++ b/docs/dyn/index.md
@@ -15,12 +15,6 @@
 * [v1beta](http://googleapis.github.io/google-api-python-client/docs/dyn/accesscontextmanager_v1beta.html)
 
 
-## adexchangebuyer
-* [v1.2](http://googleapis.github.io/google-api-python-client/docs/dyn/adexchangebuyer_v1_2.html)
-* [v1.3](http://googleapis.github.io/google-api-python-client/docs/dyn/adexchangebuyer_v1_3.html)
-* [v1.4](http://googleapis.github.io/google-api-python-client/docs/dyn/adexchangebuyer_v1_4.html)
-
-
 ## adexchangebuyer2
 * [v2beta1](http://googleapis.github.io/google-api-python-client/docs/dyn/adexchangebuyer2_v2beta1.html)
 
@@ -288,6 +282,10 @@
 * [v1](http://googleapis.github.io/google-api-python-client/docs/dyn/compute_v1.html)
 
 
+## connectors
+* [v1](http://googleapis.github.io/google-api-python-client/docs/dyn/connectors_v1.html)
+
+
 ## contactcenterinsights
 * [v1](http://googleapis.github.io/google-api-python-client/docs/dyn/contactcenterinsights_v1.html)
 
@@ -666,6 +664,7 @@
 
 
 ## networkconnectivity
+* [v1](http://googleapis.github.io/google-api-python-client/docs/dyn/networkconnectivity_v1.html)
 * [v1alpha1](http://googleapis.github.io/google-api-python-client/docs/dyn/networkconnectivity_v1alpha1.html)
 
 
diff --git a/docs/dyn/logging_v2.billingAccounts.buckets.views.html b/docs/dyn/logging_v2.billingAccounts.buckets.views.html
index c10907e..31b1974 100644
--- a/docs/dyn/logging_v2.billingAccounts.buckets.views.html
+++ b/docs/dyn/logging_v2.billingAccounts.buckets.views.html
@@ -105,19 +105,6 @@
   &quot;description&quot;: &quot;A String&quot;, # Describes this view.
   &quot;filter&quot;: &quot;A String&quot;, # Filter that restricts which log entries in a bucket are visible in this view.Filters are restricted to be a logical AND of ==/!= of any of the following: originating project/folder/organization/billing account. resource type log idFor example:SOURCE(&quot;projects/myproject&quot;) AND resource.type = &quot;gce_instance&quot; AND LOG_ID(&quot;stdout&quot;)
   &quot;name&quot;: &quot;A String&quot;, # The resource name of the view.For example:projects/my-project/locations/global/buckets/my-bucket/views/my-view
-  &quot;schema&quot;: { # Schema of a table containing logs. # Describes the schema of the logs stored in the bucket that are accessible via this view.This field is only populated for views in analytics-enabled buckets.
-    &quot;fields&quot;: [ # Describes the fields in a table.
-      { # A field in TableSchema. The fields describe the static fields in the LogEntry. Any dynamic fields generated by the customer in fields like labels and jsonPayload are not listed in the schema as they use a native JSON type field.
-        &quot;description&quot;: &quot;A String&quot;, # Optional. The field description.
-        &quot;fields&quot;: [ # Optional. Describes the nested schema fields if the type property is set to RECORD.
-          # Object with schema name: TableFieldSchema
-        ],
-        &quot;mode&quot;: &quot;A String&quot;, # Optional. The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
-        &quot;name&quot;: &quot;A String&quot;, # Required. The field name corresponding to fields in the LogEntry.
-        &quot;type&quot;: &quot;A String&quot;, # Required. The field data type. Possible values include: STRING INTEGER (or INT64) FLOAT (or FLOAT64) BOOLEAN (or BOOL) TIMESTAMP RECORD (or STRUCT)Use of RECORD/STRUT indicates that the field contains a nested schema.
-      },
-    ],
-  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The last update timestamp of the view.
 }</pre>
 </div>
diff --git a/docs/dyn/logging_v2.billingAccounts.locations.buckets.views.html b/docs/dyn/logging_v2.billingAccounts.locations.buckets.views.html
index dba4a1d..9656315 100644
--- a/docs/dyn/logging_v2.billingAccounts.locations.buckets.views.html
+++ b/docs/dyn/logging_v2.billingAccounts.locations.buckets.views.html
@@ -82,7 +82,7 @@
 <p class="firstline">Creates a view over log entries in a log bucket. A bucket may contain a maximum of 30 views.</p>
 <p class="toc_element">
   <code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>
-<p class="firstline">Deletes a view on a log bucket.</p>
+<p class="firstline">Deletes a view on a log bucket. If an UNAVAILABLE error is returned, this indicates that system is not in a state where it can delete the view. If this occurs, please try again in a few minutes.</p>
 <p class="toc_element">
   <code><a href="#list">list(parent, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Lists views on a log bucket.</p>
@@ -91,7 +91,7 @@
 <p class="firstline">Retrieves the next page of results.</p>
 <p class="toc_element">
   <code><a href="#patch">patch(name, body=None, updateMask=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Updates a view on a log bucket. This method replaces the following fields in the existing view with values from the new view: filter.</p>
+<p class="firstline">Updates a view on a log bucket. This method replaces the following fields in the existing view with values from the new view: filter. If an UNAVAILABLE error is returned, this indicates that system is not in a state where it can update the view. If this occurs, please try again in a few minutes.</p>
 <h3>Method Details</h3>
 <div class="method">
     <code class="details" id="close">close()</code>
@@ -112,19 +112,6 @@
   &quot;description&quot;: &quot;A String&quot;, # Describes this view.
   &quot;filter&quot;: &quot;A String&quot;, # Filter that restricts which log entries in a bucket are visible in this view.Filters are restricted to be a logical AND of ==/!= of any of the following: originating project/folder/organization/billing account. resource type log idFor example:SOURCE(&quot;projects/myproject&quot;) AND resource.type = &quot;gce_instance&quot; AND LOG_ID(&quot;stdout&quot;)
   &quot;name&quot;: &quot;A String&quot;, # The resource name of the view.For example:projects/my-project/locations/global/buckets/my-bucket/views/my-view
-  &quot;schema&quot;: { # Schema of a table containing logs. # Describes the schema of the logs stored in the bucket that are accessible via this view.This field is only populated for views in analytics-enabled buckets.
-    &quot;fields&quot;: [ # Describes the fields in a table.
-      { # A field in TableSchema. The fields describe the static fields in the LogEntry. Any dynamic fields generated by the customer in fields like labels and jsonPayload are not listed in the schema as they use a native JSON type field.
-        &quot;description&quot;: &quot;A String&quot;, # Optional. The field description.
-        &quot;fields&quot;: [ # Optional. Describes the nested schema fields if the type property is set to RECORD.
-          # Object with schema name: TableFieldSchema
-        ],
-        &quot;mode&quot;: &quot;A String&quot;, # Optional. The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
-        &quot;name&quot;: &quot;A String&quot;, # Required. The field name corresponding to fields in the LogEntry.
-        &quot;type&quot;: &quot;A String&quot;, # Required. The field data type. Possible values include: STRING INTEGER (or INT64) FLOAT (or FLOAT64) BOOLEAN (or BOOL) TIMESTAMP RECORD (or STRUCT)Use of RECORD/STRUT indicates that the field contains a nested schema.
-      },
-    ],
-  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The last update timestamp of the view.
 }
 
@@ -142,26 +129,13 @@
   &quot;description&quot;: &quot;A String&quot;, # Describes this view.
   &quot;filter&quot;: &quot;A String&quot;, # Filter that restricts which log entries in a bucket are visible in this view.Filters are restricted to be a logical AND of ==/!= of any of the following: originating project/folder/organization/billing account. resource type log idFor example:SOURCE(&quot;projects/myproject&quot;) AND resource.type = &quot;gce_instance&quot; AND LOG_ID(&quot;stdout&quot;)
   &quot;name&quot;: &quot;A String&quot;, # The resource name of the view.For example:projects/my-project/locations/global/buckets/my-bucket/views/my-view
-  &quot;schema&quot;: { # Schema of a table containing logs. # Describes the schema of the logs stored in the bucket that are accessible via this view.This field is only populated for views in analytics-enabled buckets.
-    &quot;fields&quot;: [ # Describes the fields in a table.
-      { # A field in TableSchema. The fields describe the static fields in the LogEntry. Any dynamic fields generated by the customer in fields like labels and jsonPayload are not listed in the schema as they use a native JSON type field.
-        &quot;description&quot;: &quot;A String&quot;, # Optional. The field description.
-        &quot;fields&quot;: [ # Optional. Describes the nested schema fields if the type property is set to RECORD.
-          # Object with schema name: TableFieldSchema
-        ],
-        &quot;mode&quot;: &quot;A String&quot;, # Optional. The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
-        &quot;name&quot;: &quot;A String&quot;, # Required. The field name corresponding to fields in the LogEntry.
-        &quot;type&quot;: &quot;A String&quot;, # Required. The field data type. Possible values include: STRING INTEGER (or INT64) FLOAT (or FLOAT64) BOOLEAN (or BOOL) TIMESTAMP RECORD (or STRUCT)Use of RECORD/STRUT indicates that the field contains a nested schema.
-      },
-    ],
-  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The last update timestamp of the view.
 }</pre>
 </div>
 
 <div class="method">
     <code class="details" id="delete">delete(name, x__xgafv=None)</code>
-  <pre>Deletes a view on a log bucket.
+  <pre>Deletes a view on a log bucket. If an UNAVAILABLE error is returned, this indicates that system is not in a state where it can delete the view. If this occurs, please try again in a few minutes.
 
 Args:
   name: string, Required. The full resource name of the view to delete: &quot;projects/[PROJECT_ID]/locations/[LOCATION_ID]/buckets/[BUCKET_ID]/views/[VIEW_ID]&quot; For example:&quot;projects/my-project/locations/global/buckets/my-bucket/views/my-view&quot; (required)
@@ -201,19 +175,6 @@
       &quot;description&quot;: &quot;A String&quot;, # Describes this view.
       &quot;filter&quot;: &quot;A String&quot;, # Filter that restricts which log entries in a bucket are visible in this view.Filters are restricted to be a logical AND of ==/!= of any of the following: originating project/folder/organization/billing account. resource type log idFor example:SOURCE(&quot;projects/myproject&quot;) AND resource.type = &quot;gce_instance&quot; AND LOG_ID(&quot;stdout&quot;)
       &quot;name&quot;: &quot;A String&quot;, # The resource name of the view.For example:projects/my-project/locations/global/buckets/my-bucket/views/my-view
-      &quot;schema&quot;: { # Schema of a table containing logs. # Describes the schema of the logs stored in the bucket that are accessible via this view.This field is only populated for views in analytics-enabled buckets.
-        &quot;fields&quot;: [ # Describes the fields in a table.
-          { # A field in TableSchema. The fields describe the static fields in the LogEntry. Any dynamic fields generated by the customer in fields like labels and jsonPayload are not listed in the schema as they use a native JSON type field.
-            &quot;description&quot;: &quot;A String&quot;, # Optional. The field description.
-            &quot;fields&quot;: [ # Optional. Describes the nested schema fields if the type property is set to RECORD.
-              # Object with schema name: TableFieldSchema
-            ],
-            &quot;mode&quot;: &quot;A String&quot;, # Optional. The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
-            &quot;name&quot;: &quot;A String&quot;, # Required. The field name corresponding to fields in the LogEntry.
-            &quot;type&quot;: &quot;A String&quot;, # Required. The field data type. Possible values include: STRING INTEGER (or INT64) FLOAT (or FLOAT64) BOOLEAN (or BOOL) TIMESTAMP RECORD (or STRUCT)Use of RECORD/STRUT indicates that the field contains a nested schema.
-          },
-        ],
-      },
       &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The last update timestamp of the view.
     },
   ],
@@ -236,7 +197,7 @@
 
 <div class="method">
     <code class="details" id="patch">patch(name, body=None, updateMask=None, x__xgafv=None)</code>
-  <pre>Updates a view on a log bucket. This method replaces the following fields in the existing view with values from the new view: filter.
+  <pre>Updates a view on a log bucket. This method replaces the following fields in the existing view with values from the new view: filter. If an UNAVAILABLE error is returned, this indicates that system is not in a state where it can update the view. If this occurs, please try again in a few minutes.
 
 Args:
   name: string, Required. The full resource name of the view to update &quot;projects/[PROJECT_ID]/locations/[LOCATION_ID]/buckets/[BUCKET_ID]/views/[VIEW_ID]&quot; For example:&quot;projects/my-project/locations/global/buckets/my-bucket/views/my-view&quot; (required)
@@ -248,19 +209,6 @@
   &quot;description&quot;: &quot;A String&quot;, # Describes this view.
   &quot;filter&quot;: &quot;A String&quot;, # Filter that restricts which log entries in a bucket are visible in this view.Filters are restricted to be a logical AND of ==/!= of any of the following: originating project/folder/organization/billing account. resource type log idFor example:SOURCE(&quot;projects/myproject&quot;) AND resource.type = &quot;gce_instance&quot; AND LOG_ID(&quot;stdout&quot;)
   &quot;name&quot;: &quot;A String&quot;, # The resource name of the view.For example:projects/my-project/locations/global/buckets/my-bucket/views/my-view
-  &quot;schema&quot;: { # Schema of a table containing logs. # Describes the schema of the logs stored in the bucket that are accessible via this view.This field is only populated for views in analytics-enabled buckets.
-    &quot;fields&quot;: [ # Describes the fields in a table.
-      { # A field in TableSchema. The fields describe the static fields in the LogEntry. Any dynamic fields generated by the customer in fields like labels and jsonPayload are not listed in the schema as they use a native JSON type field.
-        &quot;description&quot;: &quot;A String&quot;, # Optional. The field description.
-        &quot;fields&quot;: [ # Optional. Describes the nested schema fields if the type property is set to RECORD.
-          # Object with schema name: TableFieldSchema
-        ],
-        &quot;mode&quot;: &quot;A String&quot;, # Optional. The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
-        &quot;name&quot;: &quot;A String&quot;, # Required. The field name corresponding to fields in the LogEntry.
-        &quot;type&quot;: &quot;A String&quot;, # Required. The field data type. Possible values include: STRING INTEGER (or INT64) FLOAT (or FLOAT64) BOOLEAN (or BOOL) TIMESTAMP RECORD (or STRUCT)Use of RECORD/STRUT indicates that the field contains a nested schema.
-      },
-    ],
-  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The last update timestamp of the view.
 }
 
@@ -278,19 +226,6 @@
   &quot;description&quot;: &quot;A String&quot;, # Describes this view.
   &quot;filter&quot;: &quot;A String&quot;, # Filter that restricts which log entries in a bucket are visible in this view.Filters are restricted to be a logical AND of ==/!= of any of the following: originating project/folder/organization/billing account. resource type log idFor example:SOURCE(&quot;projects/myproject&quot;) AND resource.type = &quot;gce_instance&quot; AND LOG_ID(&quot;stdout&quot;)
   &quot;name&quot;: &quot;A String&quot;, # The resource name of the view.For example:projects/my-project/locations/global/buckets/my-bucket/views/my-view
-  &quot;schema&quot;: { # Schema of a table containing logs. # Describes the schema of the logs stored in the bucket that are accessible via this view.This field is only populated for views in analytics-enabled buckets.
-    &quot;fields&quot;: [ # Describes the fields in a table.
-      { # A field in TableSchema. The fields describe the static fields in the LogEntry. Any dynamic fields generated by the customer in fields like labels and jsonPayload are not listed in the schema as they use a native JSON type field.
-        &quot;description&quot;: &quot;A String&quot;, # Optional. The field description.
-        &quot;fields&quot;: [ # Optional. Describes the nested schema fields if the type property is set to RECORD.
-          # Object with schema name: TableFieldSchema
-        ],
-        &quot;mode&quot;: &quot;A String&quot;, # Optional. The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
-        &quot;name&quot;: &quot;A String&quot;, # Required. The field name corresponding to fields in the LogEntry.
-        &quot;type&quot;: &quot;A String&quot;, # Required. The field data type. Possible values include: STRING INTEGER (or INT64) FLOAT (or FLOAT64) BOOLEAN (or BOOL) TIMESTAMP RECORD (or STRUCT)Use of RECORD/STRUT indicates that the field contains a nested schema.
-      },
-    ],
-  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The last update timestamp of the view.
 }</pre>
 </div>
diff --git a/docs/dyn/logging_v2.folders.locations.buckets.views.html b/docs/dyn/logging_v2.folders.locations.buckets.views.html
index b86849a..e1dc08c 100644
--- a/docs/dyn/logging_v2.folders.locations.buckets.views.html
+++ b/docs/dyn/logging_v2.folders.locations.buckets.views.html
@@ -82,7 +82,7 @@
 <p class="firstline">Creates a view over log entries in a log bucket. A bucket may contain a maximum of 30 views.</p>
 <p class="toc_element">
   <code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>
-<p class="firstline">Deletes a view on a log bucket.</p>
+<p class="firstline">Deletes a view on a log bucket. If an UNAVAILABLE error is returned, this indicates that system is not in a state where it can delete the view. If this occurs, please try again in a few minutes.</p>
 <p class="toc_element">
   <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
 <p class="firstline">Gets a view on a log bucket..</p>
@@ -94,7 +94,7 @@
 <p class="firstline">Retrieves the next page of results.</p>
 <p class="toc_element">
   <code><a href="#patch">patch(name, body=None, updateMask=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Updates a view on a log bucket. This method replaces the following fields in the existing view with values from the new view: filter.</p>
+<p class="firstline">Updates a view on a log bucket. This method replaces the following fields in the existing view with values from the new view: filter. If an UNAVAILABLE error is returned, this indicates that system is not in a state where it can update the view. If this occurs, please try again in a few minutes.</p>
 <h3>Method Details</h3>
 <div class="method">
     <code class="details" id="close">close()</code>
@@ -115,19 +115,6 @@
   &quot;description&quot;: &quot;A String&quot;, # Describes this view.
   &quot;filter&quot;: &quot;A String&quot;, # Filter that restricts which log entries in a bucket are visible in this view.Filters are restricted to be a logical AND of ==/!= of any of the following: originating project/folder/organization/billing account. resource type log idFor example:SOURCE(&quot;projects/myproject&quot;) AND resource.type = &quot;gce_instance&quot; AND LOG_ID(&quot;stdout&quot;)
   &quot;name&quot;: &quot;A String&quot;, # The resource name of the view.For example:projects/my-project/locations/global/buckets/my-bucket/views/my-view
-  &quot;schema&quot;: { # Schema of a table containing logs. # Describes the schema of the logs stored in the bucket that are accessible via this view.This field is only populated for views in analytics-enabled buckets.
-    &quot;fields&quot;: [ # Describes the fields in a table.
-      { # A field in TableSchema. The fields describe the static fields in the LogEntry. Any dynamic fields generated by the customer in fields like labels and jsonPayload are not listed in the schema as they use a native JSON type field.
-        &quot;description&quot;: &quot;A String&quot;, # Optional. The field description.
-        &quot;fields&quot;: [ # Optional. Describes the nested schema fields if the type property is set to RECORD.
-          # Object with schema name: TableFieldSchema
-        ],
-        &quot;mode&quot;: &quot;A String&quot;, # Optional. The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
-        &quot;name&quot;: &quot;A String&quot;, # Required. The field name corresponding to fields in the LogEntry.
-        &quot;type&quot;: &quot;A String&quot;, # Required. The field data type. Possible values include: STRING INTEGER (or INT64) FLOAT (or FLOAT64) BOOLEAN (or BOOL) TIMESTAMP RECORD (or STRUCT)Use of RECORD/STRUT indicates that the field contains a nested schema.
-      },
-    ],
-  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The last update timestamp of the view.
 }
 
@@ -145,26 +132,13 @@
   &quot;description&quot;: &quot;A String&quot;, # Describes this view.
   &quot;filter&quot;: &quot;A String&quot;, # Filter that restricts which log entries in a bucket are visible in this view.Filters are restricted to be a logical AND of ==/!= of any of the following: originating project/folder/organization/billing account. resource type log idFor example:SOURCE(&quot;projects/myproject&quot;) AND resource.type = &quot;gce_instance&quot; AND LOG_ID(&quot;stdout&quot;)
   &quot;name&quot;: &quot;A String&quot;, # The resource name of the view.For example:projects/my-project/locations/global/buckets/my-bucket/views/my-view
-  &quot;schema&quot;: { # Schema of a table containing logs. # Describes the schema of the logs stored in the bucket that are accessible via this view.This field is only populated for views in analytics-enabled buckets.
-    &quot;fields&quot;: [ # Describes the fields in a table.
-      { # A field in TableSchema. The fields describe the static fields in the LogEntry. Any dynamic fields generated by the customer in fields like labels and jsonPayload are not listed in the schema as they use a native JSON type field.
-        &quot;description&quot;: &quot;A String&quot;, # Optional. The field description.
-        &quot;fields&quot;: [ # Optional. Describes the nested schema fields if the type property is set to RECORD.
-          # Object with schema name: TableFieldSchema
-        ],
-        &quot;mode&quot;: &quot;A String&quot;, # Optional. The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
-        &quot;name&quot;: &quot;A String&quot;, # Required. The field name corresponding to fields in the LogEntry.
-        &quot;type&quot;: &quot;A String&quot;, # Required. The field data type. Possible values include: STRING INTEGER (or INT64) FLOAT (or FLOAT64) BOOLEAN (or BOOL) TIMESTAMP RECORD (or STRUCT)Use of RECORD/STRUT indicates that the field contains a nested schema.
-      },
-    ],
-  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The last update timestamp of the view.
 }</pre>
 </div>
 
 <div class="method">
     <code class="details" id="delete">delete(name, x__xgafv=None)</code>
-  <pre>Deletes a view on a log bucket.
+  <pre>Deletes a view on a log bucket. If an UNAVAILABLE error is returned, this indicates that system is not in a state where it can delete the view. If this occurs, please try again in a few minutes.
 
 Args:
   name: string, Required. The full resource name of the view to delete: &quot;projects/[PROJECT_ID]/locations/[LOCATION_ID]/buckets/[BUCKET_ID]/views/[VIEW_ID]&quot; For example:&quot;projects/my-project/locations/global/buckets/my-bucket/views/my-view&quot; (required)
@@ -199,19 +173,6 @@
   &quot;description&quot;: &quot;A String&quot;, # Describes this view.
   &quot;filter&quot;: &quot;A String&quot;, # Filter that restricts which log entries in a bucket are visible in this view.Filters are restricted to be a logical AND of ==/!= of any of the following: originating project/folder/organization/billing account. resource type log idFor example:SOURCE(&quot;projects/myproject&quot;) AND resource.type = &quot;gce_instance&quot; AND LOG_ID(&quot;stdout&quot;)
   &quot;name&quot;: &quot;A String&quot;, # The resource name of the view.For example:projects/my-project/locations/global/buckets/my-bucket/views/my-view
-  &quot;schema&quot;: { # Schema of a table containing logs. # Describes the schema of the logs stored in the bucket that are accessible via this view.This field is only populated for views in analytics-enabled buckets.
-    &quot;fields&quot;: [ # Describes the fields in a table.
-      { # A field in TableSchema. The fields describe the static fields in the LogEntry. Any dynamic fields generated by the customer in fields like labels and jsonPayload are not listed in the schema as they use a native JSON type field.
-        &quot;description&quot;: &quot;A String&quot;, # Optional. The field description.
-        &quot;fields&quot;: [ # Optional. Describes the nested schema fields if the type property is set to RECORD.
-          # Object with schema name: TableFieldSchema
-        ],
-        &quot;mode&quot;: &quot;A String&quot;, # Optional. The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
-        &quot;name&quot;: &quot;A String&quot;, # Required. The field name corresponding to fields in the LogEntry.
-        &quot;type&quot;: &quot;A String&quot;, # Required. The field data type. Possible values include: STRING INTEGER (or INT64) FLOAT (or FLOAT64) BOOLEAN (or BOOL) TIMESTAMP RECORD (or STRUCT)Use of RECORD/STRUT indicates that the field contains a nested schema.
-      },
-    ],
-  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The last update timestamp of the view.
 }</pre>
 </div>
@@ -240,19 +201,6 @@
       &quot;description&quot;: &quot;A String&quot;, # Describes this view.
       &quot;filter&quot;: &quot;A String&quot;, # Filter that restricts which log entries in a bucket are visible in this view.Filters are restricted to be a logical AND of ==/!= of any of the following: originating project/folder/organization/billing account. resource type log idFor example:SOURCE(&quot;projects/myproject&quot;) AND resource.type = &quot;gce_instance&quot; AND LOG_ID(&quot;stdout&quot;)
       &quot;name&quot;: &quot;A String&quot;, # The resource name of the view.For example:projects/my-project/locations/global/buckets/my-bucket/views/my-view
-      &quot;schema&quot;: { # Schema of a table containing logs. # Describes the schema of the logs stored in the bucket that are accessible via this view.This field is only populated for views in analytics-enabled buckets.
-        &quot;fields&quot;: [ # Describes the fields in a table.
-          { # A field in TableSchema. The fields describe the static fields in the LogEntry. Any dynamic fields generated by the customer in fields like labels and jsonPayload are not listed in the schema as they use a native JSON type field.
-            &quot;description&quot;: &quot;A String&quot;, # Optional. The field description.
-            &quot;fields&quot;: [ # Optional. Describes the nested schema fields if the type property is set to RECORD.
-              # Object with schema name: TableFieldSchema
-            ],
-            &quot;mode&quot;: &quot;A String&quot;, # Optional. The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
-            &quot;name&quot;: &quot;A String&quot;, # Required. The field name corresponding to fields in the LogEntry.
-            &quot;type&quot;: &quot;A String&quot;, # Required. The field data type. Possible values include: STRING INTEGER (or INT64) FLOAT (or FLOAT64) BOOLEAN (or BOOL) TIMESTAMP RECORD (or STRUCT)Use of RECORD/STRUT indicates that the field contains a nested schema.
-          },
-        ],
-      },
       &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The last update timestamp of the view.
     },
   ],
@@ -275,7 +223,7 @@
 
 <div class="method">
     <code class="details" id="patch">patch(name, body=None, updateMask=None, x__xgafv=None)</code>
-  <pre>Updates a view on a log bucket. This method replaces the following fields in the existing view with values from the new view: filter.
+  <pre>Updates a view on a log bucket. This method replaces the following fields in the existing view with values from the new view: filter. If an UNAVAILABLE error is returned, this indicates that system is not in a state where it can update the view. If this occurs, please try again in a few minutes.
 
 Args:
   name: string, Required. The full resource name of the view to update &quot;projects/[PROJECT_ID]/locations/[LOCATION_ID]/buckets/[BUCKET_ID]/views/[VIEW_ID]&quot; For example:&quot;projects/my-project/locations/global/buckets/my-bucket/views/my-view&quot; (required)
@@ -287,19 +235,6 @@
   &quot;description&quot;: &quot;A String&quot;, # Describes this view.
   &quot;filter&quot;: &quot;A String&quot;, # Filter that restricts which log entries in a bucket are visible in this view.Filters are restricted to be a logical AND of ==/!= of any of the following: originating project/folder/organization/billing account. resource type log idFor example:SOURCE(&quot;projects/myproject&quot;) AND resource.type = &quot;gce_instance&quot; AND LOG_ID(&quot;stdout&quot;)
   &quot;name&quot;: &quot;A String&quot;, # The resource name of the view.For example:projects/my-project/locations/global/buckets/my-bucket/views/my-view
-  &quot;schema&quot;: { # Schema of a table containing logs. # Describes the schema of the logs stored in the bucket that are accessible via this view.This field is only populated for views in analytics-enabled buckets.
-    &quot;fields&quot;: [ # Describes the fields in a table.
-      { # A field in TableSchema. The fields describe the static fields in the LogEntry. Any dynamic fields generated by the customer in fields like labels and jsonPayload are not listed in the schema as they use a native JSON type field.
-        &quot;description&quot;: &quot;A String&quot;, # Optional. The field description.
-        &quot;fields&quot;: [ # Optional. Describes the nested schema fields if the type property is set to RECORD.
-          # Object with schema name: TableFieldSchema
-        ],
-        &quot;mode&quot;: &quot;A String&quot;, # Optional. The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
-        &quot;name&quot;: &quot;A String&quot;, # Required. The field name corresponding to fields in the LogEntry.
-        &quot;type&quot;: &quot;A String&quot;, # Required. The field data type. Possible values include: STRING INTEGER (or INT64) FLOAT (or FLOAT64) BOOLEAN (or BOOL) TIMESTAMP RECORD (or STRUCT)Use of RECORD/STRUT indicates that the field contains a nested schema.
-      },
-    ],
-  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The last update timestamp of the view.
 }
 
@@ -317,19 +252,6 @@
   &quot;description&quot;: &quot;A String&quot;, # Describes this view.
   &quot;filter&quot;: &quot;A String&quot;, # Filter that restricts which log entries in a bucket are visible in this view.Filters are restricted to be a logical AND of ==/!= of any of the following: originating project/folder/organization/billing account. resource type log idFor example:SOURCE(&quot;projects/myproject&quot;) AND resource.type = &quot;gce_instance&quot; AND LOG_ID(&quot;stdout&quot;)
   &quot;name&quot;: &quot;A String&quot;, # The resource name of the view.For example:projects/my-project/locations/global/buckets/my-bucket/views/my-view
-  &quot;schema&quot;: { # Schema of a table containing logs. # Describes the schema of the logs stored in the bucket that are accessible via this view.This field is only populated for views in analytics-enabled buckets.
-    &quot;fields&quot;: [ # Describes the fields in a table.
-      { # A field in TableSchema. The fields describe the static fields in the LogEntry. Any dynamic fields generated by the customer in fields like labels and jsonPayload are not listed in the schema as they use a native JSON type field.
-        &quot;description&quot;: &quot;A String&quot;, # Optional. The field description.
-        &quot;fields&quot;: [ # Optional. Describes the nested schema fields if the type property is set to RECORD.
-          # Object with schema name: TableFieldSchema
-        ],
-        &quot;mode&quot;: &quot;A String&quot;, # Optional. The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
-        &quot;name&quot;: &quot;A String&quot;, # Required. The field name corresponding to fields in the LogEntry.
-        &quot;type&quot;: &quot;A String&quot;, # Required. The field data type. Possible values include: STRING INTEGER (or INT64) FLOAT (or FLOAT64) BOOLEAN (or BOOL) TIMESTAMP RECORD (or STRUCT)Use of RECORD/STRUT indicates that the field contains a nested schema.
-      },
-    ],
-  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The last update timestamp of the view.
 }</pre>
 </div>
diff --git a/docs/dyn/logging_v2.locations.buckets.views.html b/docs/dyn/logging_v2.locations.buckets.views.html
index b52e66a..294db9f 100644
--- a/docs/dyn/logging_v2.locations.buckets.views.html
+++ b/docs/dyn/logging_v2.locations.buckets.views.html
@@ -82,7 +82,7 @@
 <p class="firstline">Creates a view over log entries in a log bucket. A bucket may contain a maximum of 30 views.</p>
 <p class="toc_element">
   <code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>
-<p class="firstline">Deletes a view on a log bucket.</p>
+<p class="firstline">Deletes a view on a log bucket. If an UNAVAILABLE error is returned, this indicates that system is not in a state where it can delete the view. If this occurs, please try again in a few minutes.</p>
 <p class="toc_element">
   <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
 <p class="firstline">Gets a view on a log bucket..</p>
@@ -94,7 +94,7 @@
 <p class="firstline">Retrieves the next page of results.</p>
 <p class="toc_element">
   <code><a href="#patch">patch(name, body=None, updateMask=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Updates a view on a log bucket. This method replaces the following fields in the existing view with values from the new view: filter.</p>
+<p class="firstline">Updates a view on a log bucket. This method replaces the following fields in the existing view with values from the new view: filter. If an UNAVAILABLE error is returned, this indicates that system is not in a state where it can update the view. If this occurs, please try again in a few minutes.</p>
 <h3>Method Details</h3>
 <div class="method">
     <code class="details" id="close">close()</code>
@@ -115,19 +115,6 @@
   &quot;description&quot;: &quot;A String&quot;, # Describes this view.
   &quot;filter&quot;: &quot;A String&quot;, # Filter that restricts which log entries in a bucket are visible in this view.Filters are restricted to be a logical AND of ==/!= of any of the following: originating project/folder/organization/billing account. resource type log idFor example:SOURCE(&quot;projects/myproject&quot;) AND resource.type = &quot;gce_instance&quot; AND LOG_ID(&quot;stdout&quot;)
   &quot;name&quot;: &quot;A String&quot;, # The resource name of the view.For example:projects/my-project/locations/global/buckets/my-bucket/views/my-view
-  &quot;schema&quot;: { # Schema of a table containing logs. # Describes the schema of the logs stored in the bucket that are accessible via this view.This field is only populated for views in analytics-enabled buckets.
-    &quot;fields&quot;: [ # Describes the fields in a table.
-      { # A field in TableSchema. The fields describe the static fields in the LogEntry. Any dynamic fields generated by the customer in fields like labels and jsonPayload are not listed in the schema as they use a native JSON type field.
-        &quot;description&quot;: &quot;A String&quot;, # Optional. The field description.
-        &quot;fields&quot;: [ # Optional. Describes the nested schema fields if the type property is set to RECORD.
-          # Object with schema name: TableFieldSchema
-        ],
-        &quot;mode&quot;: &quot;A String&quot;, # Optional. The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
-        &quot;name&quot;: &quot;A String&quot;, # Required. The field name corresponding to fields in the LogEntry.
-        &quot;type&quot;: &quot;A String&quot;, # Required. The field data type. Possible values include: STRING INTEGER (or INT64) FLOAT (or FLOAT64) BOOLEAN (or BOOL) TIMESTAMP RECORD (or STRUCT)Use of RECORD/STRUT indicates that the field contains a nested schema.
-      },
-    ],
-  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The last update timestamp of the view.
 }
 
@@ -145,26 +132,13 @@
   &quot;description&quot;: &quot;A String&quot;, # Describes this view.
   &quot;filter&quot;: &quot;A String&quot;, # Filter that restricts which log entries in a bucket are visible in this view.Filters are restricted to be a logical AND of ==/!= of any of the following: originating project/folder/organization/billing account. resource type log idFor example:SOURCE(&quot;projects/myproject&quot;) AND resource.type = &quot;gce_instance&quot; AND LOG_ID(&quot;stdout&quot;)
   &quot;name&quot;: &quot;A String&quot;, # The resource name of the view.For example:projects/my-project/locations/global/buckets/my-bucket/views/my-view
-  &quot;schema&quot;: { # Schema of a table containing logs. # Describes the schema of the logs stored in the bucket that are accessible via this view.This field is only populated for views in analytics-enabled buckets.
-    &quot;fields&quot;: [ # Describes the fields in a table.
-      { # A field in TableSchema. The fields describe the static fields in the LogEntry. Any dynamic fields generated by the customer in fields like labels and jsonPayload are not listed in the schema as they use a native JSON type field.
-        &quot;description&quot;: &quot;A String&quot;, # Optional. The field description.
-        &quot;fields&quot;: [ # Optional. Describes the nested schema fields if the type property is set to RECORD.
-          # Object with schema name: TableFieldSchema
-        ],
-        &quot;mode&quot;: &quot;A String&quot;, # Optional. The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
-        &quot;name&quot;: &quot;A String&quot;, # Required. The field name corresponding to fields in the LogEntry.
-        &quot;type&quot;: &quot;A String&quot;, # Required. The field data type. Possible values include: STRING INTEGER (or INT64) FLOAT (or FLOAT64) BOOLEAN (or BOOL) TIMESTAMP RECORD (or STRUCT)Use of RECORD/STRUT indicates that the field contains a nested schema.
-      },
-    ],
-  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The last update timestamp of the view.
 }</pre>
 </div>
 
 <div class="method">
     <code class="details" id="delete">delete(name, x__xgafv=None)</code>
-  <pre>Deletes a view on a log bucket.
+  <pre>Deletes a view on a log bucket. If an UNAVAILABLE error is returned, this indicates that system is not in a state where it can delete the view. If this occurs, please try again in a few minutes.
 
 Args:
   name: string, Required. The full resource name of the view to delete: &quot;projects/[PROJECT_ID]/locations/[LOCATION_ID]/buckets/[BUCKET_ID]/views/[VIEW_ID]&quot; For example:&quot;projects/my-project/locations/global/buckets/my-bucket/views/my-view&quot; (required)
@@ -199,19 +173,6 @@
   &quot;description&quot;: &quot;A String&quot;, # Describes this view.
   &quot;filter&quot;: &quot;A String&quot;, # Filter that restricts which log entries in a bucket are visible in this view.Filters are restricted to be a logical AND of ==/!= of any of the following: originating project/folder/organization/billing account. resource type log idFor example:SOURCE(&quot;projects/myproject&quot;) AND resource.type = &quot;gce_instance&quot; AND LOG_ID(&quot;stdout&quot;)
   &quot;name&quot;: &quot;A String&quot;, # The resource name of the view.For example:projects/my-project/locations/global/buckets/my-bucket/views/my-view
-  &quot;schema&quot;: { # Schema of a table containing logs. # Describes the schema of the logs stored in the bucket that are accessible via this view.This field is only populated for views in analytics-enabled buckets.
-    &quot;fields&quot;: [ # Describes the fields in a table.
-      { # A field in TableSchema. The fields describe the static fields in the LogEntry. Any dynamic fields generated by the customer in fields like labels and jsonPayload are not listed in the schema as they use a native JSON type field.
-        &quot;description&quot;: &quot;A String&quot;, # Optional. The field description.
-        &quot;fields&quot;: [ # Optional. Describes the nested schema fields if the type property is set to RECORD.
-          # Object with schema name: TableFieldSchema
-        ],
-        &quot;mode&quot;: &quot;A String&quot;, # Optional. The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
-        &quot;name&quot;: &quot;A String&quot;, # Required. The field name corresponding to fields in the LogEntry.
-        &quot;type&quot;: &quot;A String&quot;, # Required. The field data type. Possible values include: STRING INTEGER (or INT64) FLOAT (or FLOAT64) BOOLEAN (or BOOL) TIMESTAMP RECORD (or STRUCT)Use of RECORD/STRUT indicates that the field contains a nested schema.
-      },
-    ],
-  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The last update timestamp of the view.
 }</pre>
 </div>
@@ -240,19 +201,6 @@
       &quot;description&quot;: &quot;A String&quot;, # Describes this view.
       &quot;filter&quot;: &quot;A String&quot;, # Filter that restricts which log entries in a bucket are visible in this view.Filters are restricted to be a logical AND of ==/!= of any of the following: originating project/folder/organization/billing account. resource type log idFor example:SOURCE(&quot;projects/myproject&quot;) AND resource.type = &quot;gce_instance&quot; AND LOG_ID(&quot;stdout&quot;)
       &quot;name&quot;: &quot;A String&quot;, # The resource name of the view.For example:projects/my-project/locations/global/buckets/my-bucket/views/my-view
-      &quot;schema&quot;: { # Schema of a table containing logs. # Describes the schema of the logs stored in the bucket that are accessible via this view.This field is only populated for views in analytics-enabled buckets.
-        &quot;fields&quot;: [ # Describes the fields in a table.
-          { # A field in TableSchema. The fields describe the static fields in the LogEntry. Any dynamic fields generated by the customer in fields like labels and jsonPayload are not listed in the schema as they use a native JSON type field.
-            &quot;description&quot;: &quot;A String&quot;, # Optional. The field description.
-            &quot;fields&quot;: [ # Optional. Describes the nested schema fields if the type property is set to RECORD.
-              # Object with schema name: TableFieldSchema
-            ],
-            &quot;mode&quot;: &quot;A String&quot;, # Optional. The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
-            &quot;name&quot;: &quot;A String&quot;, # Required. The field name corresponding to fields in the LogEntry.
-            &quot;type&quot;: &quot;A String&quot;, # Required. The field data type. Possible values include: STRING INTEGER (or INT64) FLOAT (or FLOAT64) BOOLEAN (or BOOL) TIMESTAMP RECORD (or STRUCT)Use of RECORD/STRUT indicates that the field contains a nested schema.
-          },
-        ],
-      },
       &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The last update timestamp of the view.
     },
   ],
@@ -275,7 +223,7 @@
 
 <div class="method">
     <code class="details" id="patch">patch(name, body=None, updateMask=None, x__xgafv=None)</code>
-  <pre>Updates a view on a log bucket. This method replaces the following fields in the existing view with values from the new view: filter.
+  <pre>Updates a view on a log bucket. This method replaces the following fields in the existing view with values from the new view: filter. If an UNAVAILABLE error is returned, this indicates that system is not in a state where it can update the view. If this occurs, please try again in a few minutes.
 
 Args:
   name: string, Required. The full resource name of the view to update &quot;projects/[PROJECT_ID]/locations/[LOCATION_ID]/buckets/[BUCKET_ID]/views/[VIEW_ID]&quot; For example:&quot;projects/my-project/locations/global/buckets/my-bucket/views/my-view&quot; (required)
@@ -287,19 +235,6 @@
   &quot;description&quot;: &quot;A String&quot;, # Describes this view.
   &quot;filter&quot;: &quot;A String&quot;, # Filter that restricts which log entries in a bucket are visible in this view.Filters are restricted to be a logical AND of ==/!= of any of the following: originating project/folder/organization/billing account. resource type log idFor example:SOURCE(&quot;projects/myproject&quot;) AND resource.type = &quot;gce_instance&quot; AND LOG_ID(&quot;stdout&quot;)
   &quot;name&quot;: &quot;A String&quot;, # The resource name of the view.For example:projects/my-project/locations/global/buckets/my-bucket/views/my-view
-  &quot;schema&quot;: { # Schema of a table containing logs. # Describes the schema of the logs stored in the bucket that are accessible via this view.This field is only populated for views in analytics-enabled buckets.
-    &quot;fields&quot;: [ # Describes the fields in a table.
-      { # A field in TableSchema. The fields describe the static fields in the LogEntry. Any dynamic fields generated by the customer in fields like labels and jsonPayload are not listed in the schema as they use a native JSON type field.
-        &quot;description&quot;: &quot;A String&quot;, # Optional. The field description.
-        &quot;fields&quot;: [ # Optional. Describes the nested schema fields if the type property is set to RECORD.
-          # Object with schema name: TableFieldSchema
-        ],
-        &quot;mode&quot;: &quot;A String&quot;, # Optional. The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
-        &quot;name&quot;: &quot;A String&quot;, # Required. The field name corresponding to fields in the LogEntry.
-        &quot;type&quot;: &quot;A String&quot;, # Required. The field data type. Possible values include: STRING INTEGER (or INT64) FLOAT (or FLOAT64) BOOLEAN (or BOOL) TIMESTAMP RECORD (or STRUCT)Use of RECORD/STRUT indicates that the field contains a nested schema.
-      },
-    ],
-  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The last update timestamp of the view.
 }
 
@@ -317,19 +252,6 @@
   &quot;description&quot;: &quot;A String&quot;, # Describes this view.
   &quot;filter&quot;: &quot;A String&quot;, # Filter that restricts which log entries in a bucket are visible in this view.Filters are restricted to be a logical AND of ==/!= of any of the following: originating project/folder/organization/billing account. resource type log idFor example:SOURCE(&quot;projects/myproject&quot;) AND resource.type = &quot;gce_instance&quot; AND LOG_ID(&quot;stdout&quot;)
   &quot;name&quot;: &quot;A String&quot;, # The resource name of the view.For example:projects/my-project/locations/global/buckets/my-bucket/views/my-view
-  &quot;schema&quot;: { # Schema of a table containing logs. # Describes the schema of the logs stored in the bucket that are accessible via this view.This field is only populated for views in analytics-enabled buckets.
-    &quot;fields&quot;: [ # Describes the fields in a table.
-      { # A field in TableSchema. The fields describe the static fields in the LogEntry. Any dynamic fields generated by the customer in fields like labels and jsonPayload are not listed in the schema as they use a native JSON type field.
-        &quot;description&quot;: &quot;A String&quot;, # Optional. The field description.
-        &quot;fields&quot;: [ # Optional. Describes the nested schema fields if the type property is set to RECORD.
-          # Object with schema name: TableFieldSchema
-        ],
-        &quot;mode&quot;: &quot;A String&quot;, # Optional. The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
-        &quot;name&quot;: &quot;A String&quot;, # Required. The field name corresponding to fields in the LogEntry.
-        &quot;type&quot;: &quot;A String&quot;, # Required. The field data type. Possible values include: STRING INTEGER (or INT64) FLOAT (or FLOAT64) BOOLEAN (or BOOL) TIMESTAMP RECORD (or STRUCT)Use of RECORD/STRUT indicates that the field contains a nested schema.
-      },
-    ],
-  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The last update timestamp of the view.
 }</pre>
 </div>
diff --git a/docs/dyn/logging_v2.organizations.locations.buckets.views.html b/docs/dyn/logging_v2.organizations.locations.buckets.views.html
index ea9efe7..4cf9592 100644
--- a/docs/dyn/logging_v2.organizations.locations.buckets.views.html
+++ b/docs/dyn/logging_v2.organizations.locations.buckets.views.html
@@ -82,7 +82,7 @@
 <p class="firstline">Creates a view over log entries in a log bucket. A bucket may contain a maximum of 30 views.</p>
 <p class="toc_element">
   <code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>
-<p class="firstline">Deletes a view on a log bucket.</p>
+<p class="firstline">Deletes a view on a log bucket. If an UNAVAILABLE error is returned, this indicates that system is not in a state where it can delete the view. If this occurs, please try again in a few minutes.</p>
 <p class="toc_element">
   <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
 <p class="firstline">Gets a view on a log bucket..</p>
@@ -94,7 +94,7 @@
 <p class="firstline">Retrieves the next page of results.</p>
 <p class="toc_element">
   <code><a href="#patch">patch(name, body=None, updateMask=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Updates a view on a log bucket. This method replaces the following fields in the existing view with values from the new view: filter.</p>
+<p class="firstline">Updates a view on a log bucket. This method replaces the following fields in the existing view with values from the new view: filter. If an UNAVAILABLE error is returned, this indicates that system is not in a state where it can update the view. If this occurs, please try again in a few minutes.</p>
 <h3>Method Details</h3>
 <div class="method">
     <code class="details" id="close">close()</code>
@@ -115,19 +115,6 @@
   &quot;description&quot;: &quot;A String&quot;, # Describes this view.
   &quot;filter&quot;: &quot;A String&quot;, # Filter that restricts which log entries in a bucket are visible in this view.Filters are restricted to be a logical AND of ==/!= of any of the following: originating project/folder/organization/billing account. resource type log idFor example:SOURCE(&quot;projects/myproject&quot;) AND resource.type = &quot;gce_instance&quot; AND LOG_ID(&quot;stdout&quot;)
   &quot;name&quot;: &quot;A String&quot;, # The resource name of the view.For example:projects/my-project/locations/global/buckets/my-bucket/views/my-view
-  &quot;schema&quot;: { # Schema of a table containing logs. # Describes the schema of the logs stored in the bucket that are accessible via this view.This field is only populated for views in analytics-enabled buckets.
-    &quot;fields&quot;: [ # Describes the fields in a table.
-      { # A field in TableSchema. The fields describe the static fields in the LogEntry. Any dynamic fields generated by the customer in fields like labels and jsonPayload are not listed in the schema as they use a native JSON type field.
-        &quot;description&quot;: &quot;A String&quot;, # Optional. The field description.
-        &quot;fields&quot;: [ # Optional. Describes the nested schema fields if the type property is set to RECORD.
-          # Object with schema name: TableFieldSchema
-        ],
-        &quot;mode&quot;: &quot;A String&quot;, # Optional. The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
-        &quot;name&quot;: &quot;A String&quot;, # Required. The field name corresponding to fields in the LogEntry.
-        &quot;type&quot;: &quot;A String&quot;, # Required. The field data type. Possible values include: STRING INTEGER (or INT64) FLOAT (or FLOAT64) BOOLEAN (or BOOL) TIMESTAMP RECORD (or STRUCT)Use of RECORD/STRUT indicates that the field contains a nested schema.
-      },
-    ],
-  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The last update timestamp of the view.
 }
 
@@ -145,26 +132,13 @@
   &quot;description&quot;: &quot;A String&quot;, # Describes this view.
   &quot;filter&quot;: &quot;A String&quot;, # Filter that restricts which log entries in a bucket are visible in this view.Filters are restricted to be a logical AND of ==/!= of any of the following: originating project/folder/organization/billing account. resource type log idFor example:SOURCE(&quot;projects/myproject&quot;) AND resource.type = &quot;gce_instance&quot; AND LOG_ID(&quot;stdout&quot;)
   &quot;name&quot;: &quot;A String&quot;, # The resource name of the view.For example:projects/my-project/locations/global/buckets/my-bucket/views/my-view
-  &quot;schema&quot;: { # Schema of a table containing logs. # Describes the schema of the logs stored in the bucket that are accessible via this view.This field is only populated for views in analytics-enabled buckets.
-    &quot;fields&quot;: [ # Describes the fields in a table.
-      { # A field in TableSchema. The fields describe the static fields in the LogEntry. Any dynamic fields generated by the customer in fields like labels and jsonPayload are not listed in the schema as they use a native JSON type field.
-        &quot;description&quot;: &quot;A String&quot;, # Optional. The field description.
-        &quot;fields&quot;: [ # Optional. Describes the nested schema fields if the type property is set to RECORD.
-          # Object with schema name: TableFieldSchema
-        ],
-        &quot;mode&quot;: &quot;A String&quot;, # Optional. The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
-        &quot;name&quot;: &quot;A String&quot;, # Required. The field name corresponding to fields in the LogEntry.
-        &quot;type&quot;: &quot;A String&quot;, # Required. The field data type. Possible values include: STRING INTEGER (or INT64) FLOAT (or FLOAT64) BOOLEAN (or BOOL) TIMESTAMP RECORD (or STRUCT)Use of RECORD/STRUT indicates that the field contains a nested schema.
-      },
-    ],
-  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The last update timestamp of the view.
 }</pre>
 </div>
 
 <div class="method">
     <code class="details" id="delete">delete(name, x__xgafv=None)</code>
-  <pre>Deletes a view on a log bucket.
+  <pre>Deletes a view on a log bucket. If an UNAVAILABLE error is returned, this indicates that system is not in a state where it can delete the view. If this occurs, please try again in a few minutes.
 
 Args:
   name: string, Required. The full resource name of the view to delete: &quot;projects/[PROJECT_ID]/locations/[LOCATION_ID]/buckets/[BUCKET_ID]/views/[VIEW_ID]&quot; For example:&quot;projects/my-project/locations/global/buckets/my-bucket/views/my-view&quot; (required)
@@ -199,19 +173,6 @@
   &quot;description&quot;: &quot;A String&quot;, # Describes this view.
   &quot;filter&quot;: &quot;A String&quot;, # Filter that restricts which log entries in a bucket are visible in this view.Filters are restricted to be a logical AND of ==/!= of any of the following: originating project/folder/organization/billing account. resource type log idFor example:SOURCE(&quot;projects/myproject&quot;) AND resource.type = &quot;gce_instance&quot; AND LOG_ID(&quot;stdout&quot;)
   &quot;name&quot;: &quot;A String&quot;, # The resource name of the view.For example:projects/my-project/locations/global/buckets/my-bucket/views/my-view
-  &quot;schema&quot;: { # Schema of a table containing logs. # Describes the schema of the logs stored in the bucket that are accessible via this view.This field is only populated for views in analytics-enabled buckets.
-    &quot;fields&quot;: [ # Describes the fields in a table.
-      { # A field in TableSchema. The fields describe the static fields in the LogEntry. Any dynamic fields generated by the customer in fields like labels and jsonPayload are not listed in the schema as they use a native JSON type field.
-        &quot;description&quot;: &quot;A String&quot;, # Optional. The field description.
-        &quot;fields&quot;: [ # Optional. Describes the nested schema fields if the type property is set to RECORD.
-          # Object with schema name: TableFieldSchema
-        ],
-        &quot;mode&quot;: &quot;A String&quot;, # Optional. The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
-        &quot;name&quot;: &quot;A String&quot;, # Required. The field name corresponding to fields in the LogEntry.
-        &quot;type&quot;: &quot;A String&quot;, # Required. The field data type. Possible values include: STRING INTEGER (or INT64) FLOAT (or FLOAT64) BOOLEAN (or BOOL) TIMESTAMP RECORD (or STRUCT)Use of RECORD/STRUT indicates that the field contains a nested schema.
-      },
-    ],
-  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The last update timestamp of the view.
 }</pre>
 </div>
@@ -240,19 +201,6 @@
       &quot;description&quot;: &quot;A String&quot;, # Describes this view.
       &quot;filter&quot;: &quot;A String&quot;, # Filter that restricts which log entries in a bucket are visible in this view.Filters are restricted to be a logical AND of ==/!= of any of the following: originating project/folder/organization/billing account. resource type log idFor example:SOURCE(&quot;projects/myproject&quot;) AND resource.type = &quot;gce_instance&quot; AND LOG_ID(&quot;stdout&quot;)
       &quot;name&quot;: &quot;A String&quot;, # The resource name of the view.For example:projects/my-project/locations/global/buckets/my-bucket/views/my-view
-      &quot;schema&quot;: { # Schema of a table containing logs. # Describes the schema of the logs stored in the bucket that are accessible via this view.This field is only populated for views in analytics-enabled buckets.
-        &quot;fields&quot;: [ # Describes the fields in a table.
-          { # A field in TableSchema. The fields describe the static fields in the LogEntry. Any dynamic fields generated by the customer in fields like labels and jsonPayload are not listed in the schema as they use a native JSON type field.
-            &quot;description&quot;: &quot;A String&quot;, # Optional. The field description.
-            &quot;fields&quot;: [ # Optional. Describes the nested schema fields if the type property is set to RECORD.
-              # Object with schema name: TableFieldSchema
-            ],
-            &quot;mode&quot;: &quot;A String&quot;, # Optional. The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
-            &quot;name&quot;: &quot;A String&quot;, # Required. The field name corresponding to fields in the LogEntry.
-            &quot;type&quot;: &quot;A String&quot;, # Required. The field data type. Possible values include: STRING INTEGER (or INT64) FLOAT (or FLOAT64) BOOLEAN (or BOOL) TIMESTAMP RECORD (or STRUCT)Use of RECORD/STRUT indicates that the field contains a nested schema.
-          },
-        ],
-      },
       &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The last update timestamp of the view.
     },
   ],
@@ -275,7 +223,7 @@
 
 <div class="method">
     <code class="details" id="patch">patch(name, body=None, updateMask=None, x__xgafv=None)</code>
-  <pre>Updates a view on a log bucket. This method replaces the following fields in the existing view with values from the new view: filter.
+  <pre>Updates a view on a log bucket. This method replaces the following fields in the existing view with values from the new view: filter. If an UNAVAILABLE error is returned, this indicates that system is not in a state where it can update the view. If this occurs, please try again in a few minutes.
 
 Args:
   name: string, Required. The full resource name of the view to update &quot;projects/[PROJECT_ID]/locations/[LOCATION_ID]/buckets/[BUCKET_ID]/views/[VIEW_ID]&quot; For example:&quot;projects/my-project/locations/global/buckets/my-bucket/views/my-view&quot; (required)
@@ -287,19 +235,6 @@
   &quot;description&quot;: &quot;A String&quot;, # Describes this view.
   &quot;filter&quot;: &quot;A String&quot;, # Filter that restricts which log entries in a bucket are visible in this view.Filters are restricted to be a logical AND of ==/!= of any of the following: originating project/folder/organization/billing account. resource type log idFor example:SOURCE(&quot;projects/myproject&quot;) AND resource.type = &quot;gce_instance&quot; AND LOG_ID(&quot;stdout&quot;)
   &quot;name&quot;: &quot;A String&quot;, # The resource name of the view.For example:projects/my-project/locations/global/buckets/my-bucket/views/my-view
-  &quot;schema&quot;: { # Schema of a table containing logs. # Describes the schema of the logs stored in the bucket that are accessible via this view.This field is only populated for views in analytics-enabled buckets.
-    &quot;fields&quot;: [ # Describes the fields in a table.
-      { # A field in TableSchema. The fields describe the static fields in the LogEntry. Any dynamic fields generated by the customer in fields like labels and jsonPayload are not listed in the schema as they use a native JSON type field.
-        &quot;description&quot;: &quot;A String&quot;, # Optional. The field description.
-        &quot;fields&quot;: [ # Optional. Describes the nested schema fields if the type property is set to RECORD.
-          # Object with schema name: TableFieldSchema
-        ],
-        &quot;mode&quot;: &quot;A String&quot;, # Optional. The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
-        &quot;name&quot;: &quot;A String&quot;, # Required. The field name corresponding to fields in the LogEntry.
-        &quot;type&quot;: &quot;A String&quot;, # Required. The field data type. Possible values include: STRING INTEGER (or INT64) FLOAT (or FLOAT64) BOOLEAN (or BOOL) TIMESTAMP RECORD (or STRUCT)Use of RECORD/STRUT indicates that the field contains a nested schema.
-      },
-    ],
-  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The last update timestamp of the view.
 }
 
@@ -317,19 +252,6 @@
   &quot;description&quot;: &quot;A String&quot;, # Describes this view.
   &quot;filter&quot;: &quot;A String&quot;, # Filter that restricts which log entries in a bucket are visible in this view.Filters are restricted to be a logical AND of ==/!= of any of the following: originating project/folder/organization/billing account. resource type log idFor example:SOURCE(&quot;projects/myproject&quot;) AND resource.type = &quot;gce_instance&quot; AND LOG_ID(&quot;stdout&quot;)
   &quot;name&quot;: &quot;A String&quot;, # The resource name of the view.For example:projects/my-project/locations/global/buckets/my-bucket/views/my-view
-  &quot;schema&quot;: { # Schema of a table containing logs. # Describes the schema of the logs stored in the bucket that are accessible via this view.This field is only populated for views in analytics-enabled buckets.
-    &quot;fields&quot;: [ # Describes the fields in a table.
-      { # A field in TableSchema. The fields describe the static fields in the LogEntry. Any dynamic fields generated by the customer in fields like labels and jsonPayload are not listed in the schema as they use a native JSON type field.
-        &quot;description&quot;: &quot;A String&quot;, # Optional. The field description.
-        &quot;fields&quot;: [ # Optional. Describes the nested schema fields if the type property is set to RECORD.
-          # Object with schema name: TableFieldSchema
-        ],
-        &quot;mode&quot;: &quot;A String&quot;, # Optional. The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
-        &quot;name&quot;: &quot;A String&quot;, # Required. The field name corresponding to fields in the LogEntry.
-        &quot;type&quot;: &quot;A String&quot;, # Required. The field data type. Possible values include: STRING INTEGER (or INT64) FLOAT (or FLOAT64) BOOLEAN (or BOOL) TIMESTAMP RECORD (or STRUCT)Use of RECORD/STRUT indicates that the field contains a nested schema.
-      },
-    ],
-  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The last update timestamp of the view.
 }</pre>
 </div>
diff --git a/docs/dyn/logging_v2.projects.locations.buckets.views.html b/docs/dyn/logging_v2.projects.locations.buckets.views.html
index ec47065..9fe4756 100644
--- a/docs/dyn/logging_v2.projects.locations.buckets.views.html
+++ b/docs/dyn/logging_v2.projects.locations.buckets.views.html
@@ -82,7 +82,7 @@
 <p class="firstline">Creates a view over log entries in a log bucket. A bucket may contain a maximum of 30 views.</p>
 <p class="toc_element">
   <code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>
-<p class="firstline">Deletes a view on a log bucket.</p>
+<p class="firstline">Deletes a view on a log bucket. If an UNAVAILABLE error is returned, this indicates that system is not in a state where it can delete the view. If this occurs, please try again in a few minutes.</p>
 <p class="toc_element">
   <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
 <p class="firstline">Gets a view on a log bucket..</p>
@@ -94,7 +94,7 @@
 <p class="firstline">Retrieves the next page of results.</p>
 <p class="toc_element">
   <code><a href="#patch">patch(name, body=None, updateMask=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Updates a view on a log bucket. This method replaces the following fields in the existing view with values from the new view: filter.</p>
+<p class="firstline">Updates a view on a log bucket. This method replaces the following fields in the existing view with values from the new view: filter. If an UNAVAILABLE error is returned, this indicates that system is not in a state where it can update the view. If this occurs, please try again in a few minutes.</p>
 <h3>Method Details</h3>
 <div class="method">
     <code class="details" id="close">close()</code>
@@ -115,19 +115,6 @@
   &quot;description&quot;: &quot;A String&quot;, # Describes this view.
   &quot;filter&quot;: &quot;A String&quot;, # Filter that restricts which log entries in a bucket are visible in this view.Filters are restricted to be a logical AND of ==/!= of any of the following: originating project/folder/organization/billing account. resource type log idFor example:SOURCE(&quot;projects/myproject&quot;) AND resource.type = &quot;gce_instance&quot; AND LOG_ID(&quot;stdout&quot;)
   &quot;name&quot;: &quot;A String&quot;, # The resource name of the view.For example:projects/my-project/locations/global/buckets/my-bucket/views/my-view
-  &quot;schema&quot;: { # Schema of a table containing logs. # Describes the schema of the logs stored in the bucket that are accessible via this view.This field is only populated for views in analytics-enabled buckets.
-    &quot;fields&quot;: [ # Describes the fields in a table.
-      { # A field in TableSchema. The fields describe the static fields in the LogEntry. Any dynamic fields generated by the customer in fields like labels and jsonPayload are not listed in the schema as they use a native JSON type field.
-        &quot;description&quot;: &quot;A String&quot;, # Optional. The field description.
-        &quot;fields&quot;: [ # Optional. Describes the nested schema fields if the type property is set to RECORD.
-          # Object with schema name: TableFieldSchema
-        ],
-        &quot;mode&quot;: &quot;A String&quot;, # Optional. The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
-        &quot;name&quot;: &quot;A String&quot;, # Required. The field name corresponding to fields in the LogEntry.
-        &quot;type&quot;: &quot;A String&quot;, # Required. The field data type. Possible values include: STRING INTEGER (or INT64) FLOAT (or FLOAT64) BOOLEAN (or BOOL) TIMESTAMP RECORD (or STRUCT)Use of RECORD/STRUT indicates that the field contains a nested schema.
-      },
-    ],
-  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The last update timestamp of the view.
 }
 
@@ -145,26 +132,13 @@
   &quot;description&quot;: &quot;A String&quot;, # Describes this view.
   &quot;filter&quot;: &quot;A String&quot;, # Filter that restricts which log entries in a bucket are visible in this view.Filters are restricted to be a logical AND of ==/!= of any of the following: originating project/folder/organization/billing account. resource type log idFor example:SOURCE(&quot;projects/myproject&quot;) AND resource.type = &quot;gce_instance&quot; AND LOG_ID(&quot;stdout&quot;)
   &quot;name&quot;: &quot;A String&quot;, # The resource name of the view.For example:projects/my-project/locations/global/buckets/my-bucket/views/my-view
-  &quot;schema&quot;: { # Schema of a table containing logs. # Describes the schema of the logs stored in the bucket that are accessible via this view.This field is only populated for views in analytics-enabled buckets.
-    &quot;fields&quot;: [ # Describes the fields in a table.
-      { # A field in TableSchema. The fields describe the static fields in the LogEntry. Any dynamic fields generated by the customer in fields like labels and jsonPayload are not listed in the schema as they use a native JSON type field.
-        &quot;description&quot;: &quot;A String&quot;, # Optional. The field description.
-        &quot;fields&quot;: [ # Optional. Describes the nested schema fields if the type property is set to RECORD.
-          # Object with schema name: TableFieldSchema
-        ],
-        &quot;mode&quot;: &quot;A String&quot;, # Optional. The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
-        &quot;name&quot;: &quot;A String&quot;, # Required. The field name corresponding to fields in the LogEntry.
-        &quot;type&quot;: &quot;A String&quot;, # Required. The field data type. Possible values include: STRING INTEGER (or INT64) FLOAT (or FLOAT64) BOOLEAN (or BOOL) TIMESTAMP RECORD (or STRUCT)Use of RECORD/STRUT indicates that the field contains a nested schema.
-      },
-    ],
-  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The last update timestamp of the view.
 }</pre>
 </div>
 
 <div class="method">
     <code class="details" id="delete">delete(name, x__xgafv=None)</code>
-  <pre>Deletes a view on a log bucket.
+  <pre>Deletes a view on a log bucket. If an UNAVAILABLE error is returned, this indicates that system is not in a state where it can delete the view. If this occurs, please try again in a few minutes.
 
 Args:
   name: string, Required. The full resource name of the view to delete: &quot;projects/[PROJECT_ID]/locations/[LOCATION_ID]/buckets/[BUCKET_ID]/views/[VIEW_ID]&quot; For example:&quot;projects/my-project/locations/global/buckets/my-bucket/views/my-view&quot; (required)
@@ -199,19 +173,6 @@
   &quot;description&quot;: &quot;A String&quot;, # Describes this view.
   &quot;filter&quot;: &quot;A String&quot;, # Filter that restricts which log entries in a bucket are visible in this view.Filters are restricted to be a logical AND of ==/!= of any of the following: originating project/folder/organization/billing account. resource type log idFor example:SOURCE(&quot;projects/myproject&quot;) AND resource.type = &quot;gce_instance&quot; AND LOG_ID(&quot;stdout&quot;)
   &quot;name&quot;: &quot;A String&quot;, # The resource name of the view.For example:projects/my-project/locations/global/buckets/my-bucket/views/my-view
-  &quot;schema&quot;: { # Schema of a table containing logs. # Describes the schema of the logs stored in the bucket that are accessible via this view.This field is only populated for views in analytics-enabled buckets.
-    &quot;fields&quot;: [ # Describes the fields in a table.
-      { # A field in TableSchema. The fields describe the static fields in the LogEntry. Any dynamic fields generated by the customer in fields like labels and jsonPayload are not listed in the schema as they use a native JSON type field.
-        &quot;description&quot;: &quot;A String&quot;, # Optional. The field description.
-        &quot;fields&quot;: [ # Optional. Describes the nested schema fields if the type property is set to RECORD.
-          # Object with schema name: TableFieldSchema
-        ],
-        &quot;mode&quot;: &quot;A String&quot;, # Optional. The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
-        &quot;name&quot;: &quot;A String&quot;, # Required. The field name corresponding to fields in the LogEntry.
-        &quot;type&quot;: &quot;A String&quot;, # Required. The field data type. Possible values include: STRING INTEGER (or INT64) FLOAT (or FLOAT64) BOOLEAN (or BOOL) TIMESTAMP RECORD (or STRUCT)Use of RECORD/STRUT indicates that the field contains a nested schema.
-      },
-    ],
-  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The last update timestamp of the view.
 }</pre>
 </div>
@@ -240,19 +201,6 @@
       &quot;description&quot;: &quot;A String&quot;, # Describes this view.
       &quot;filter&quot;: &quot;A String&quot;, # Filter that restricts which log entries in a bucket are visible in this view.Filters are restricted to be a logical AND of ==/!= of any of the following: originating project/folder/organization/billing account. resource type log idFor example:SOURCE(&quot;projects/myproject&quot;) AND resource.type = &quot;gce_instance&quot; AND LOG_ID(&quot;stdout&quot;)
       &quot;name&quot;: &quot;A String&quot;, # The resource name of the view.For example:projects/my-project/locations/global/buckets/my-bucket/views/my-view
-      &quot;schema&quot;: { # Schema of a table containing logs. # Describes the schema of the logs stored in the bucket that are accessible via this view.This field is only populated for views in analytics-enabled buckets.
-        &quot;fields&quot;: [ # Describes the fields in a table.
-          { # A field in TableSchema. The fields describe the static fields in the LogEntry. Any dynamic fields generated by the customer in fields like labels and jsonPayload are not listed in the schema as they use a native JSON type field.
-            &quot;description&quot;: &quot;A String&quot;, # Optional. The field description.
-            &quot;fields&quot;: [ # Optional. Describes the nested schema fields if the type property is set to RECORD.
-              # Object with schema name: TableFieldSchema
-            ],
-            &quot;mode&quot;: &quot;A String&quot;, # Optional. The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
-            &quot;name&quot;: &quot;A String&quot;, # Required. The field name corresponding to fields in the LogEntry.
-            &quot;type&quot;: &quot;A String&quot;, # Required. The field data type. Possible values include: STRING INTEGER (or INT64) FLOAT (or FLOAT64) BOOLEAN (or BOOL) TIMESTAMP RECORD (or STRUCT)Use of RECORD/STRUT indicates that the field contains a nested schema.
-          },
-        ],
-      },
       &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The last update timestamp of the view.
     },
   ],
@@ -275,7 +223,7 @@
 
 <div class="method">
     <code class="details" id="patch">patch(name, body=None, updateMask=None, x__xgafv=None)</code>
-  <pre>Updates a view on a log bucket. This method replaces the following fields in the existing view with values from the new view: filter.
+  <pre>Updates a view on a log bucket. This method replaces the following fields in the existing view with values from the new view: filter. If an UNAVAILABLE error is returned, this indicates that system is not in a state where it can update the view. If this occurs, please try again in a few minutes.
 
 Args:
   name: string, Required. The full resource name of the view to update &quot;projects/[PROJECT_ID]/locations/[LOCATION_ID]/buckets/[BUCKET_ID]/views/[VIEW_ID]&quot; For example:&quot;projects/my-project/locations/global/buckets/my-bucket/views/my-view&quot; (required)
@@ -287,19 +235,6 @@
   &quot;description&quot;: &quot;A String&quot;, # Describes this view.
   &quot;filter&quot;: &quot;A String&quot;, # Filter that restricts which log entries in a bucket are visible in this view.Filters are restricted to be a logical AND of ==/!= of any of the following: originating project/folder/organization/billing account. resource type log idFor example:SOURCE(&quot;projects/myproject&quot;) AND resource.type = &quot;gce_instance&quot; AND LOG_ID(&quot;stdout&quot;)
   &quot;name&quot;: &quot;A String&quot;, # The resource name of the view.For example:projects/my-project/locations/global/buckets/my-bucket/views/my-view
-  &quot;schema&quot;: { # Schema of a table containing logs. # Describes the schema of the logs stored in the bucket that are accessible via this view.This field is only populated for views in analytics-enabled buckets.
-    &quot;fields&quot;: [ # Describes the fields in a table.
-      { # A field in TableSchema. The fields describe the static fields in the LogEntry. Any dynamic fields generated by the customer in fields like labels and jsonPayload are not listed in the schema as they use a native JSON type field.
-        &quot;description&quot;: &quot;A String&quot;, # Optional. The field description.
-        &quot;fields&quot;: [ # Optional. Describes the nested schema fields if the type property is set to RECORD.
-          # Object with schema name: TableFieldSchema
-        ],
-        &quot;mode&quot;: &quot;A String&quot;, # Optional. The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
-        &quot;name&quot;: &quot;A String&quot;, # Required. The field name corresponding to fields in the LogEntry.
-        &quot;type&quot;: &quot;A String&quot;, # Required. The field data type. Possible values include: STRING INTEGER (or INT64) FLOAT (or FLOAT64) BOOLEAN (or BOOL) TIMESTAMP RECORD (or STRUCT)Use of RECORD/STRUT indicates that the field contains a nested schema.
-      },
-    ],
-  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The last update timestamp of the view.
 }
 
@@ -317,19 +252,6 @@
   &quot;description&quot;: &quot;A String&quot;, # Describes this view.
   &quot;filter&quot;: &quot;A String&quot;, # Filter that restricts which log entries in a bucket are visible in this view.Filters are restricted to be a logical AND of ==/!= of any of the following: originating project/folder/organization/billing account. resource type log idFor example:SOURCE(&quot;projects/myproject&quot;) AND resource.type = &quot;gce_instance&quot; AND LOG_ID(&quot;stdout&quot;)
   &quot;name&quot;: &quot;A String&quot;, # The resource name of the view.For example:projects/my-project/locations/global/buckets/my-bucket/views/my-view
-  &quot;schema&quot;: { # Schema of a table containing logs. # Describes the schema of the logs stored in the bucket that are accessible via this view.This field is only populated for views in analytics-enabled buckets.
-    &quot;fields&quot;: [ # Describes the fields in a table.
-      { # A field in TableSchema. The fields describe the static fields in the LogEntry. Any dynamic fields generated by the customer in fields like labels and jsonPayload are not listed in the schema as they use a native JSON type field.
-        &quot;description&quot;: &quot;A String&quot;, # Optional. The field description.
-        &quot;fields&quot;: [ # Optional. Describes the nested schema fields if the type property is set to RECORD.
-          # Object with schema name: TableFieldSchema
-        ],
-        &quot;mode&quot;: &quot;A String&quot;, # Optional. The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
-        &quot;name&quot;: &quot;A String&quot;, # Required. The field name corresponding to fields in the LogEntry.
-        &quot;type&quot;: &quot;A String&quot;, # Required. The field data type. Possible values include: STRING INTEGER (or INT64) FLOAT (or FLOAT64) BOOLEAN (or BOOL) TIMESTAMP RECORD (or STRUCT)Use of RECORD/STRUT indicates that the field contains a nested schema.
-      },
-    ],
-  },
   &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The last update timestamp of the view.
 }</pre>
 </div>
diff --git a/docs/dyn/monitoring_v3.projects.alertPolicies.html b/docs/dyn/monitoring_v3.projects.alertPolicies.html
index f0f4255..da0fd0c 100644
--- a/docs/dyn/monitoring_v3.projects.alertPolicies.html
+++ b/docs/dyn/monitoring_v3.projects.alertPolicies.html
@@ -112,7 +112,7 @@
 
 { # A description of the conditions under which some aspect of your system is considered to be &quot;unhealthy&quot; and the ways to notify people or services about this state. For an overview of alert policies, see Introduction to Alerting (https://cloud.google.com/monitoring/alerts/).
   &quot;alertStrategy&quot;: { # Control over how the notification channels in notification_channels are notified when this alert fires. # Control over how this alert policy&#x27;s notification channels are notified.
-    &quot;autoClose&quot;: &quot;A String&quot;, # If an alert policy that was active has no data for this log, any open incidents will close
+    &quot;autoClose&quot;: &quot;A String&quot;, # If an alert policy that was active has no data for this long, any open incidents will close
     &quot;notificationRateLimit&quot;: { # Control over the rate of notifications sent to this alert policy&#x27;s notification channels. # Required for alert policies with a LogMatch condition.This limit is not implemented for alert policies that are not log-based.
       &quot;period&quot;: &quot;A String&quot;, # Not more than one notification per period.
     },
@@ -229,7 +229,7 @@
 
     { # A description of the conditions under which some aspect of your system is considered to be &quot;unhealthy&quot; and the ways to notify people or services about this state. For an overview of alert policies, see Introduction to Alerting (https://cloud.google.com/monitoring/alerts/).
   &quot;alertStrategy&quot;: { # Control over how the notification channels in notification_channels are notified when this alert fires. # Control over how this alert policy&#x27;s notification channels are notified.
-    &quot;autoClose&quot;: &quot;A String&quot;, # If an alert policy that was active has no data for this log, any open incidents will close
+    &quot;autoClose&quot;: &quot;A String&quot;, # If an alert policy that was active has no data for this long, any open incidents will close
     &quot;notificationRateLimit&quot;: { # Control over the rate of notifications sent to this alert policy&#x27;s notification channels. # Required for alert policies with a LogMatch condition.This limit is not implemented for alert policies that are not log-based.
       &quot;period&quot;: &quot;A String&quot;, # Not more than one notification per period.
     },
@@ -371,7 +371,7 @@
 
     { # A description of the conditions under which some aspect of your system is considered to be &quot;unhealthy&quot; and the ways to notify people or services about this state. For an overview of alert policies, see Introduction to Alerting (https://cloud.google.com/monitoring/alerts/).
   &quot;alertStrategy&quot;: { # Control over how the notification channels in notification_channels are notified when this alert fires. # Control over how this alert policy&#x27;s notification channels are notified.
-    &quot;autoClose&quot;: &quot;A String&quot;, # If an alert policy that was active has no data for this log, any open incidents will close
+    &quot;autoClose&quot;: &quot;A String&quot;, # If an alert policy that was active has no data for this long, any open incidents will close
     &quot;notificationRateLimit&quot;: { # Control over the rate of notifications sent to this alert policy&#x27;s notification channels. # Required for alert policies with a LogMatch condition.This limit is not implemented for alert policies that are not log-based.
       &quot;period&quot;: &quot;A String&quot;, # Not more than one notification per period.
     },
@@ -501,7 +501,7 @@
   &quot;alertPolicies&quot;: [ # The returned alert policies.
     { # A description of the conditions under which some aspect of your system is considered to be &quot;unhealthy&quot; and the ways to notify people or services about this state. For an overview of alert policies, see Introduction to Alerting (https://cloud.google.com/monitoring/alerts/).
       &quot;alertStrategy&quot;: { # Control over how the notification channels in notification_channels are notified when this alert fires. # Control over how this alert policy&#x27;s notification channels are notified.
-        &quot;autoClose&quot;: &quot;A String&quot;, # If an alert policy that was active has no data for this log, any open incidents will close
+        &quot;autoClose&quot;: &quot;A String&quot;, # If an alert policy that was active has no data for this long, any open incidents will close
         &quot;notificationRateLimit&quot;: { # Control over the rate of notifications sent to this alert policy&#x27;s notification channels. # Required for alert policies with a LogMatch condition.This limit is not implemented for alert policies that are not log-based.
           &quot;period&quot;: &quot;A String&quot;, # Not more than one notification per period.
         },
@@ -638,7 +638,7 @@
 
 { # A description of the conditions under which some aspect of your system is considered to be &quot;unhealthy&quot; and the ways to notify people or services about this state. For an overview of alert policies, see Introduction to Alerting (https://cloud.google.com/monitoring/alerts/).
   &quot;alertStrategy&quot;: { # Control over how the notification channels in notification_channels are notified when this alert fires. # Control over how this alert policy&#x27;s notification channels are notified.
-    &quot;autoClose&quot;: &quot;A String&quot;, # If an alert policy that was active has no data for this log, any open incidents will close
+    &quot;autoClose&quot;: &quot;A String&quot;, # If an alert policy that was active has no data for this long, any open incidents will close
     &quot;notificationRateLimit&quot;: { # Control over the rate of notifications sent to this alert policy&#x27;s notification channels. # Required for alert policies with a LogMatch condition.This limit is not implemented for alert policies that are not log-based.
       &quot;period&quot;: &quot;A String&quot;, # Not more than one notification per period.
     },
@@ -756,7 +756,7 @@
 
     { # A description of the conditions under which some aspect of your system is considered to be &quot;unhealthy&quot; and the ways to notify people or services about this state. For an overview of alert policies, see Introduction to Alerting (https://cloud.google.com/monitoring/alerts/).
   &quot;alertStrategy&quot;: { # Control over how the notification channels in notification_channels are notified when this alert fires. # Control over how this alert policy&#x27;s notification channels are notified.
-    &quot;autoClose&quot;: &quot;A String&quot;, # If an alert policy that was active has no data for this log, any open incidents will close
+    &quot;autoClose&quot;: &quot;A String&quot;, # If an alert policy that was active has no data for this long, any open incidents will close
     &quot;notificationRateLimit&quot;: { # Control over the rate of notifications sent to this alert policy&#x27;s notification channels. # Required for alert policies with a LogMatch condition.This limit is not implemented for alert policies that are not log-based.
       &quot;period&quot;: &quot;A String&quot;, # Not more than one notification per period.
     },
diff --git a/docs/dyn/monitoring_v3.projects.timeSeries.html b/docs/dyn/monitoring_v3.projects.timeSeries.html
index 813b5ac..53e2b07 100644
--- a/docs/dyn/monitoring_v3.projects.timeSeries.html
+++ b/docs/dyn/monitoring_v3.projects.timeSeries.html
@@ -81,6 +81,9 @@
   <code><a href="#create">create(name, body=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Creates or adds data to one or more time series. The response is empty if all time series in the request were written. If any time series could not be written, a corresponding failure message is included in the error response.</p>
 <p class="toc_element">
+  <code><a href="#createService">createService(name, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Creates or adds data to one or more service time series. A service time series is a time series for a metric from a Google Cloud service. The response is empty if all time series in the request were written. If any time series could not be written, a corresponding failure message is included in the error response. This endpoint rejects writes to user-defined metrics. This method is only for use by Google Cloud services. Use projects.timeSeries.create instead.</p>
+<p class="toc_element">
   <code><a href="#list">list(name, aggregation_alignmentPeriod=None, aggregation_crossSeriesReducer=None, aggregation_groupByFields=None, aggregation_perSeriesAligner=None, filter=None, interval_endTime=None, interval_startTime=None, orderBy=None, pageSize=None, pageToken=None, secondaryAggregation_alignmentPeriod=None, secondaryAggregation_crossSeriesReducer=None, secondaryAggregation_groupByFields=None, secondaryAggregation_perSeriesAligner=None, view=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Lists time series that match a filter. This method does not require a Workspace.</p>
 <p class="toc_element">
@@ -204,6 +207,111 @@
 </div>
 
 <div class="method">
+    <code class="details" id="createService">createService(name, body=None, x__xgafv=None)</code>
+  <pre>Creates or adds data to one or more service time series. A service time series is a time series for a metric from a Google Cloud service. The response is empty if all time series in the request were written. If any time series could not be written, a corresponding failure message is included in the error response. This endpoint rejects writes to user-defined metrics. This method is only for use by Google Cloud services. Use projects.timeSeries.create instead.
+
+Args:
+  name: string, Required. The project (https://cloud.google.com/monitoring/api/v3#project_name) on which to execute the request. The format is: projects/[PROJECT_ID_OR_NUMBER]  (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # The CreateTimeSeries request.
+  &quot;timeSeries&quot;: [ # Required. The new data to be added to a list of time series. Adds at most one data point to each of several time series. The new data point must be more recent than any other point in its time series. Each TimeSeries value must fully specify a unique time series by supplying all label values for the metric and the monitored resource.The maximum number of TimeSeries objects per Create request is 200.
+    { # A collection of data points that describes the time-varying values of a metric. A time series is identified by a combination of a fully-specified monitored resource and a fully-specified metric. This type is used for both listing and creating time series.
+      &quot;metadata&quot;: { # Auxiliary metadata for a MonitoredResource object. MonitoredResource objects contain the minimum set of information to uniquely identify a monitored resource instance. There is some other useful auxiliary metadata. Monitoring and Logging use an ingestion pipeline to extract metadata for cloud resources of all types, and store the metadata in this message. # Output only. The associated monitored resource metadata. When reading a time series, this field will include metadata labels that are explicitly named in the reduction. When creating a time series, this field is ignored.
+        &quot;systemLabels&quot;: { # Output only. Values for predefined system metadata labels. System labels are a kind of metadata extracted by Google, including &quot;machine_image&quot;, &quot;vpc&quot;, &quot;subnet_id&quot;, &quot;security_group&quot;, &quot;name&quot;, etc. System label values can be only strings, Boolean values, or a list of strings. For example: { &quot;name&quot;: &quot;my-test-instance&quot;, &quot;security_group&quot;: [&quot;a&quot;, &quot;b&quot;, &quot;c&quot;], &quot;spot_instance&quot;: false }
+          &quot;a_key&quot;: &quot;&quot;, # Properties of the object.
+        },
+        &quot;userLabels&quot;: { # Output only. A map of user-defined metadata labels.
+          &quot;a_key&quot;: &quot;A String&quot;,
+        },
+      },
+      &quot;metric&quot;: { # A specific metric, identified by specifying values for all of the labels of a MetricDescriptor. # The associated metric. A fully-specified metric used to identify the time series.
+        &quot;labels&quot;: { # The set of label values that uniquely identify this metric. All labels listed in the MetricDescriptor must be assigned values.
+          &quot;a_key&quot;: &quot;A String&quot;,
+        },
+        &quot;type&quot;: &quot;A String&quot;, # An existing metric type, see google.api.MetricDescriptor. For example, custom.googleapis.com/invoice/paid/amount.
+      },
+      &quot;metricKind&quot;: &quot;A String&quot;, # The metric kind of the time series. When listing time series, this metric kind might be different from the metric kind of the associated metric if this time series is an alignment or reduction of other time series.When creating a time series, this field is optional. If present, it must be the same as the metric kind of the associated metric. If the associated metric&#x27;s descriptor must be auto-created, then this field specifies the metric kind of the new descriptor and must be either GAUGE (the default) or CUMULATIVE.
+      &quot;points&quot;: [ # The data points of this time series. When listing time series, points are returned in reverse time order.When creating a time series, this field must contain exactly one point and the point&#x27;s type must be the same as the value type of the associated metric. If the associated metric&#x27;s descriptor must be auto-created, then the value type of the descriptor is determined by the point&#x27;s type, which must be BOOL, INT64, DOUBLE, or DISTRIBUTION.
+        { # A single data point in a time series.
+          &quot;interval&quot;: { # A closed time interval. It extends from the start time to the end time, and includes both: [startTime, endTime]. Valid time intervals depend on the MetricKind (https://cloud.google.com/monitoring/api/ref_v3/rest/v3/projects.metricDescriptors#MetricKind) of the metric value. The end time must not be earlier than the start time. When writing data points, the start time must not be more than 25 hours in the past and the end time must not be more than five minutes in the future. For GAUGE metrics, the startTime value is technically optional; if no value is specified, the start time defaults to the value of the end time, and the interval represents a single point in time. If both start and end times are specified, they must be identical. Such an interval is valid only for GAUGE metrics, which are point-in-time measurements. The end time of a new interval must be at least a millisecond after the end time of the previous interval. For DELTA metrics, the start time and end time must specify a non-zero interval, with subsequent points specifying contiguous and non-overlapping intervals. For DELTA metrics, the start time of the next interval must be at least a millisecond after the end time of the previous interval. For CUMULATIVE metrics, the start time and end time must specify a a non-zero interval, with subsequent points specifying the same start time and increasing end times, until an event resets the cumulative value to zero and sets a new start time for the following points. The new start time must be at least a millisecond after the end time of the previous interval. The start time of a new interval must be at least a millisecond after the end time of the previous interval because intervals are closed. If the start time of a new interval is the same as the end time of the previous interval, then data written at the new start time could overwrite data written at the previous end time. # The time interval to which the data point applies. For GAUGE metrics, the start time is optional, but if it is supplied, it must equal the end time. For DELTA metrics, the start and end time should specify a non-zero interval, with subsequent points specifying contiguous and non-overlapping intervals. For CUMULATIVE metrics, the start and end time should specify a non-zero interval, with subsequent points specifying the same start time and increasing end times, until an event resets the cumulative value to zero and sets a new start time for the following points.
+            &quot;endTime&quot;: &quot;A String&quot;, # Required. The end of the time interval.
+            &quot;startTime&quot;: &quot;A String&quot;, # Optional. The beginning of the time interval. The default value for the start time is the end time. The start time must not be later than the end time.
+          },
+          &quot;value&quot;: { # A single strongly-typed value. # The value of the data point.
+            &quot;boolValue&quot;: True or False, # A Boolean value: true or false.
+            &quot;distributionValue&quot;: { # Distribution contains summary statistics for a population of values. It optionally contains a histogram representing the distribution of those values across a set of buckets.The summary statistics are the count, mean, sum of the squared deviation from the mean, the minimum, and the maximum of the set of population of values. The histogram is based on a sequence of buckets and gives a count of values that fall into each bucket. The boundaries of the buckets are given either explicitly or by formulas for buckets of fixed or exponentially increasing widths.Although it is not forbidden, it is generally a bad idea to include non-finite values (infinities or NaNs) in the population of values, as this will render the mean and sum_of_squared_deviation fields meaningless. # A distribution value.
+              &quot;bucketCounts&quot;: [ # Required in the Cloud Monitoring API v3. The values for each bucket specified in bucket_options. The sum of the values in bucketCounts must equal the value in the count field of the Distribution object. The order of the bucket counts follows the numbering schemes described for the three bucket types. The underflow bucket has number 0; the finite buckets, if any, have numbers 1 through N-2; and the overflow bucket has number N-1. The size of bucket_counts must not be greater than N. If the size is less than N, then the remaining buckets are assigned values of zero.
+                &quot;A String&quot;,
+              ],
+              &quot;bucketOptions&quot;: { # BucketOptions describes the bucket boundaries used to create a histogram for the distribution. The buckets can be in a linear sequence, an exponential sequence, or each bucket can be specified explicitly. BucketOptions does not include the number of values in each bucket.A bucket has an inclusive lower bound and exclusive upper bound for the values that are counted for that bucket. The upper bound of a bucket must be strictly greater than the lower bound. The sequence of N buckets for a distribution consists of an underflow bucket (number 0), zero or more finite buckets (number 1 through N - 2) and an overflow bucket (number N - 1). The buckets are contiguous: the lower bound of bucket i (i &gt; 0) is the same as the upper bound of bucket i - 1. The buckets span the whole range of finite values: lower bound of the underflow bucket is -infinity and the upper bound of the overflow bucket is +infinity. The finite buckets are so-called because both bounds are finite. # Required in the Cloud Monitoring API v3. Defines the histogram bucket boundaries.
+                &quot;explicitBuckets&quot;: { # Specifies a set of buckets with arbitrary widths.There are size(bounds) + 1 (= N) buckets. Bucket i has the following boundaries:Upper bound (0 &lt;= i &lt; N-1): boundsi Lower bound (1 &lt;= i &lt; N); boundsi - 1The bounds field must contain at least one element. If bounds has only one element, then there are no finite buckets, and that single element is the common boundary of the overflow and underflow buckets. # The explicit buckets.
+                  &quot;bounds&quot;: [ # The values must be monotonically increasing.
+                    3.14,
+                  ],
+                },
+                &quot;exponentialBuckets&quot;: { # Specifies an exponential sequence of buckets that have a width that is proportional to the value of the lower bound. Each bucket represents a constant relative uncertainty on a specific value in the bucket.There are num_finite_buckets + 2 (= N) buckets. Bucket i has the following boundaries:Upper bound (0 &lt;= i &lt; N-1): scale * (growth_factor ^ i). Lower bound (1 &lt;= i &lt; N): scale * (growth_factor ^ (i - 1)). # The exponential buckets.
+                  &quot;growthFactor&quot;: 3.14, # Must be greater than 1.
+                  &quot;numFiniteBuckets&quot;: 42, # Must be greater than 0.
+                  &quot;scale&quot;: 3.14, # Must be greater than 0.
+                },
+                &quot;linearBuckets&quot;: { # Specifies a linear sequence of buckets that all have the same width (except overflow and underflow). Each bucket represents a constant absolute uncertainty on the specific value in the bucket.There are num_finite_buckets + 2 (= N) buckets. Bucket i has the following boundaries:Upper bound (0 &lt;= i &lt; N-1): offset + (width * i). Lower bound (1 &lt;= i &lt; N): offset + (width * (i - 1)). # The linear bucket.
+                  &quot;numFiniteBuckets&quot;: 42, # Must be greater than 0.
+                  &quot;offset&quot;: 3.14, # Lower bound of the first bucket.
+                  &quot;width&quot;: 3.14, # Must be greater than 0.
+                },
+              },
+              &quot;count&quot;: &quot;A String&quot;, # The number of values in the population. Must be non-negative. This value must equal the sum of the values in bucket_counts if a histogram is provided.
+              &quot;exemplars&quot;: [ # Must be in increasing order of value field.
+                { # Exemplars are example points that may be used to annotate aggregated distribution values. They are metadata that gives information about a particular value added to a Distribution bucket, such as a trace ID that was active when a value was added. They may contain further information, such as a example values and timestamps, origin, etc.
+                  &quot;attachments&quot;: [ # Contextual information about the example value. Examples are:Trace: type.googleapis.com/google.monitoring.v3.SpanContextLiteral string: type.googleapis.com/google.protobuf.StringValueLabels dropped during aggregation: type.googleapis.com/google.monitoring.v3.DroppedLabelsThere may be only a single attachment of any given message type in a single exemplar, and this is enforced by the system.
+                    {
+                      &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+                    },
+                  ],
+                  &quot;timestamp&quot;: &quot;A String&quot;, # The observation (sampling) time of the above value.
+                  &quot;value&quot;: 3.14, # Value of the exemplar point. This value determines to which bucket the exemplar belongs.
+                },
+              ],
+              &quot;mean&quot;: 3.14, # The arithmetic mean of the values in the population. If count is zero then this field must be zero.
+              &quot;range&quot;: { # The range of the population values. # If specified, contains the range of the population values. The field must not be present if the count is zero. This field is presently ignored by the Cloud Monitoring API v3.
+                &quot;max&quot;: 3.14, # The maximum of the population values.
+                &quot;min&quot;: 3.14, # The minimum of the population values.
+              },
+              &quot;sumOfSquaredDeviation&quot;: 3.14, # The sum of squared deviations from the mean of the values in the population. For values x_i this is: Sum[i=1..n]((x_i - mean)^2) Knuth, &quot;The Art of Computer Programming&quot;, Vol. 2, page 232, 3rd edition describes Welford&#x27;s method for accumulating this sum in one pass.If count is zero then this field must be zero.
+            },
+            &quot;doubleValue&quot;: 3.14, # A 64-bit double-precision floating-point number. Its magnitude is approximately ±10±300 and it has 16 significant digits of precision.
+            &quot;int64Value&quot;: &quot;A String&quot;, # A 64-bit integer. Its range is approximately ±9.2x1018.
+            &quot;stringValue&quot;: &quot;A String&quot;, # A variable-length string value.
+          },
+        },
+      ],
+      &quot;resource&quot;: { # An object representing a resource that can be used for monitoring, logging, billing, or other purposes. Examples include virtual machine instances, databases, and storage devices such as disks. The type field identifies a MonitoredResourceDescriptor object that describes the resource&#x27;s schema. Information in the labels field identifies the actual resource and its attributes according to the schema. For example, a particular Compute Engine VM instance could be represented by the following object, because the MonitoredResourceDescriptor for &quot;gce_instance&quot; has labels &quot;instance_id&quot; and &quot;zone&quot;: { &quot;type&quot;: &quot;gce_instance&quot;, &quot;labels&quot;: { &quot;instance_id&quot;: &quot;12345678901234&quot;, &quot;zone&quot;: &quot;us-central1-a&quot; }} # The associated monitored resource. Custom metrics can use only certain monitored resource types in their time series data. For more information, see Monitored resources for custom metrics (https://cloud.google.com/monitoring/custom-metrics/creating-metrics#custom-metric-resources).
+        &quot;labels&quot;: { # Required. Values for all of the labels listed in the associated monitored resource descriptor. For example, Compute Engine VM instances use the labels &quot;project_id&quot;, &quot;instance_id&quot;, and &quot;zone&quot;.
+          &quot;a_key&quot;: &quot;A String&quot;,
+        },
+        &quot;type&quot;: &quot;A String&quot;, # Required. The monitored resource type. This field must match the type field of a MonitoredResourceDescriptor object. For example, the type of a Compute Engine VM instance is gce_instance. For a list of types, see Monitoring resource types (https://cloud.google.com/monitoring/api/resources) and Logging resource types (https://cloud.google.com/logging/docs/api/v2/resource-list).
+      },
+      &quot;unit&quot;: &quot;A String&quot;, # The units in which the metric value is reported. It is only applicable if the value_type is INT64, DOUBLE, or DISTRIBUTION. The unit defines the representation of the stored metric values.
+      &quot;valueType&quot;: &quot;A String&quot;, # The value type of the time series. When listing time series, this value type might be different from the value type of the associated metric if this time series is an alignment or reduction of other time series.When creating a time series, this field is optional. If present, it must be the same as the type of the data in the points field.
+    },
+  ],
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); } The JSON representation for Empty is empty JSON object {}.
+}</pre>
+</div>
+
+<div class="method">
     <code class="details" id="list">list(name, aggregation_alignmentPeriod=None, aggregation_crossSeriesReducer=None, aggregation_groupByFields=None, aggregation_perSeriesAligner=None, filter=None, interval_endTime=None, interval_startTime=None, orderBy=None, pageSize=None, pageToken=None, secondaryAggregation_alignmentPeriod=None, secondaryAggregation_crossSeriesReducer=None, secondaryAggregation_groupByFields=None, secondaryAggregation_perSeriesAligner=None, view=None, x__xgafv=None)</code>
   <pre>Lists time series that match a filter. This method does not require a Workspace.
 
diff --git a/docs/dyn/networkconnectivity_v1.html b/docs/dyn/networkconnectivity_v1.html
new file mode 100644
index 0000000..d16c277
--- /dev/null
+++ b/docs/dyn/networkconnectivity_v1.html
@@ -0,0 +1,111 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="networkconnectivity_v1.html">Network Connectivity API</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="networkconnectivity_v1.projects.html">projects()</a></code>
+</p>
+<p class="firstline">Returns the projects Resource.</p>
+
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#new_batch_http_request">new_batch_http_request()</a></code></p>
+<p class="firstline">Create a BatchHttpRequest object based on the discovery document.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="new_batch_http_request">new_batch_http_request()</code>
+  <pre>Create a BatchHttpRequest object based on the discovery document.
+
+        Args:
+          callback: callable, A callback to be called for each response, of the
+            form callback(id, response, exception). The first parameter is the
+            request id, and the second is the deserialized response object. The
+            third is an apiclient.errors.HttpError exception object if an HTTP
+            error occurred while processing the request, or None if no error
+            occurred.
+
+        Returns:
+          A BatchHttpRequest object based on the discovery document.
+        </pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/networkconnectivity_v1.projects.html b/docs/dyn/networkconnectivity_v1.projects.html
new file mode 100644
index 0000000..5b0b99c
--- /dev/null
+++ b/docs/dyn/networkconnectivity_v1.projects.html
@@ -0,0 +1,91 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="networkconnectivity_v1.html">Network Connectivity API</a> . <a href="networkconnectivity_v1.projects.html">projects</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="networkconnectivity_v1.projects.locations.html">locations()</a></code>
+</p>
+<p class="firstline">Returns the locations Resource.</p>
+
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/networkconnectivity_v1.projects.locations.global_.html b/docs/dyn/networkconnectivity_v1.projects.locations.global_.html
new file mode 100644
index 0000000..a556e35
--- /dev/null
+++ b/docs/dyn/networkconnectivity_v1.projects.locations.global_.html
@@ -0,0 +1,96 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="networkconnectivity_v1.html">Network Connectivity API</a> . <a href="networkconnectivity_v1.projects.html">projects</a> . <a href="networkconnectivity_v1.projects.locations.html">locations</a> . <a href="networkconnectivity_v1.projects.locations.global_.html">global_</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="networkconnectivity_v1.projects.locations.global_.hubs.html">hubs()</a></code>
+</p>
+<p class="firstline">Returns the hubs Resource.</p>
+
+<p class="toc_element">
+  <code><a href="networkconnectivity_v1.projects.locations.global_.policyBasedRoutes.html">policyBasedRoutes()</a></code>
+</p>
+<p class="firstline">Returns the policyBasedRoutes Resource.</p>
+
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/networkconnectivity_v1.projects.locations.global_.hubs.html b/docs/dyn/networkconnectivity_v1.projects.locations.global_.hubs.html
new file mode 100644
index 0000000..88a6df9
--- /dev/null
+++ b/docs/dyn/networkconnectivity_v1.projects.locations.global_.hubs.html
@@ -0,0 +1,516 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="networkconnectivity_v1.html">Network Connectivity API</a> . <a href="networkconnectivity_v1.projects.html">projects</a> . <a href="networkconnectivity_v1.projects.locations.html">locations</a> . <a href="networkconnectivity_v1.projects.locations.global_.html">global_</a> . <a href="networkconnectivity_v1.projects.locations.global_.hubs.html">hubs</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#create">create(parent, body=None, hubId=None, requestId=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Creates a new hub in the specified project.</p>
+<p class="toc_element">
+  <code><a href="#delete">delete(name, requestId=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Deletes the specified hub.</p>
+<p class="toc_element">
+  <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets details about the specified hub.</p>
+<p class="toc_element">
+  <code><a href="#getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.</p>
+<p class="toc_element">
+  <code><a href="#list">list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Lists hubs in a given project.</p>
+<p class="toc_element">
+  <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
+<p class="firstline">Retrieves the next page of results.</p>
+<p class="toc_element">
+  <code><a href="#patch">patch(name, body=None, requestId=None, updateMask=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Updates the description and/or labels of the specified hub.</p>
+<p class="toc_element">
+  <code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.</p>
+<p class="toc_element">
+  <code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may "fail open" without warning.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="create">create(parent, body=None, hubId=None, requestId=None, x__xgafv=None)</code>
+  <pre>Creates a new hub in the specified project.
+
+Args:
+  parent: string, Required. The parent resource. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # A hub is a collection of spokes. A single hub can contain spokes from multiple regions. However, all of a hub&#x27;s spokes must be associated with resources that reside in the same VPC network.
+  &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time the hub was created.
+  &quot;description&quot;: &quot;A String&quot;, # An optional description of the hub.
+  &quot;labels&quot;: { # Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements).
+    &quot;a_key&quot;: &quot;A String&quot;,
+  },
+  &quot;name&quot;: &quot;A String&quot;, # Immutable. The name of the hub. Hub names must be unique. They use the following form: `projects/{project_number}/locations/global/hubs/{hub_id}`
+  &quot;routingVpcs&quot;: [ # The VPC network associated with this hub&#x27;s spokes. All of the VPN tunnels, VLAN attachments, and router appliance instances referenced by this hub&#x27;s spokes must belong to this VPC network. This field is read-only. Network Connectivity Center automatically populates it based on the set of spokes attached to the hub.
+    { # RoutingVPC contains information about the VPC network that is associated with a hub&#x27;s spokes.
+      &quot;uri&quot;: &quot;A String&quot;, # The URI of the VPC network.
+    },
+  ],
+  &quot;state&quot;: &quot;A String&quot;, # Output only. The current lifecycle state of this hub.
+  &quot;uniqueId&quot;: &quot;A String&quot;, # Output only. The Google-generated UUID for the hub. This value is unique across all hub resources. If a hub is deleted and another with the same name is created, the new hub is assigned a different unique_id.
+  &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time the hub was last updated.
+}
+
+  hubId: string, Optional. A unique identifier for the hub.
+  requestId: string, Optional. A unique request ID (optional). If you specify this ID, you can use it in cases when you need to retry your request. When you need to retry, this ID lets the server know that it can ignore the request if it has already been completed. The server guarantees that for at least 60 minutes after the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check to see whether the original operation was received. If it was, the server ignores the second request. This behavior prevents clients from mistakenly creating duplicate commitments. The request ID must be a valid UUID, with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # This resource represents a long-running operation that is the result of a network API call.
+  &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+  &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+    &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+      {
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    ],
+    &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+  },
+  &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+  &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="delete">delete(name, requestId=None, x__xgafv=None)</code>
+  <pre>Deletes the specified hub.
+
+Args:
+  name: string, Required. The name of the hub to delete. (required)
+  requestId: string, Optional. A unique request ID (optional). If you specify this ID, you can use it in cases when you need to retry your request. When you need to retry, this ID lets the server know that it can ignore the request if it has already been completed. The server guarantees that for at least 60 minutes after the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check to see whether the original operation was received. If it was, the server ignores the second request. This behavior prevents clients from mistakenly creating duplicate commitments. The request ID must be a valid UUID, with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # This resource represents a long-running operation that is the result of a network API call.
+  &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+  &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+    &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+      {
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    ],
+    &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+  },
+  &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+  &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="get">get(name, x__xgafv=None)</code>
+  <pre>Gets details about the specified hub.
+
+Args:
+  name: string, Required. The name of the hub resource to get. (required)
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # A hub is a collection of spokes. A single hub can contain spokes from multiple regions. However, all of a hub&#x27;s spokes must be associated with resources that reside in the same VPC network.
+  &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time the hub was created.
+  &quot;description&quot;: &quot;A String&quot;, # An optional description of the hub.
+  &quot;labels&quot;: { # Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements).
+    &quot;a_key&quot;: &quot;A String&quot;,
+  },
+  &quot;name&quot;: &quot;A String&quot;, # Immutable. The name of the hub. Hub names must be unique. They use the following form: `projects/{project_number}/locations/global/hubs/{hub_id}`
+  &quot;routingVpcs&quot;: [ # The VPC network associated with this hub&#x27;s spokes. All of the VPN tunnels, VLAN attachments, and router appliance instances referenced by this hub&#x27;s spokes must belong to this VPC network. This field is read-only. Network Connectivity Center automatically populates it based on the set of spokes attached to the hub.
+    { # RoutingVPC contains information about the VPC network that is associated with a hub&#x27;s spokes.
+      &quot;uri&quot;: &quot;A String&quot;, # The URI of the VPC network.
+    },
+  ],
+  &quot;state&quot;: &quot;A String&quot;, # Output only. The current lifecycle state of this hub.
+  &quot;uniqueId&quot;: &quot;A String&quot;, # Output only. The Google-generated UUID for the hub. This value is unique across all hub resources. If a hub is deleted and another with the same name is created, the new hub is assigned a different unique_id.
+  &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time the hub was last updated.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</code>
+  <pre>Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.
+
+Args:
+  resource: string, REQUIRED: The resource for which the policy is being requested. See the operation documentation for the appropriate value for this field. (required)
+  options_requestedPolicyVersion: integer, Optional. The policy format version to be returned. Valid values are 0, 1, and 3. Requests specifying an invalid value will be rejected. Requests for policies with any conditional bindings must specify version 3. Policies without any conditional bindings may specify any valid value or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+  &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
+    { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
+      &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
+        { # Provides the configuration for logging a type of permissions. Example: { &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; } ] } This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting jose@example.com from DATA_READ logging.
+          &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+            &quot;A String&quot;,
+          ],
+          &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
+        },
+      ],
+      &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+    },
+  ],
+  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+    { # Associates `members` with a `role`.
+      &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+        &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+        &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
+        &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+        &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+      },
+      &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+        &quot;A String&quot;,
+      ],
+      &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+    },
+  ],
+  &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+  &quot;version&quot;: 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list">list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, x__xgafv=None)</code>
+  <pre>Lists hubs in a given project.
+
+Args:
+  parent: string, Required. The parent resource&#x27;s name. (required)
+  filter: string, An expression that filters the results listed in the response.
+  orderBy: string, Sort the results by a certain order.
+  pageSize: integer, The maximum number of results per page that should be returned.
+  pageToken: string, The page token.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Response for HubService.ListHubs method.
+  &quot;hubs&quot;: [ # The requested hubs.
+    { # A hub is a collection of spokes. A single hub can contain spokes from multiple regions. However, all of a hub&#x27;s spokes must be associated with resources that reside in the same VPC network.
+      &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time the hub was created.
+      &quot;description&quot;: &quot;A String&quot;, # An optional description of the hub.
+      &quot;labels&quot;: { # Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements).
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+      &quot;name&quot;: &quot;A String&quot;, # Immutable. The name of the hub. Hub names must be unique. They use the following form: `projects/{project_number}/locations/global/hubs/{hub_id}`
+      &quot;routingVpcs&quot;: [ # The VPC network associated with this hub&#x27;s spokes. All of the VPN tunnels, VLAN attachments, and router appliance instances referenced by this hub&#x27;s spokes must belong to this VPC network. This field is read-only. Network Connectivity Center automatically populates it based on the set of spokes attached to the hub.
+        { # RoutingVPC contains information about the VPC network that is associated with a hub&#x27;s spokes.
+          &quot;uri&quot;: &quot;A String&quot;, # The URI of the VPC network.
+        },
+      ],
+      &quot;state&quot;: &quot;A String&quot;, # Output only. The current lifecycle state of this hub.
+      &quot;uniqueId&quot;: &quot;A String&quot;, # Output only. The Google-generated UUID for the hub. This value is unique across all hub resources. If a hub is deleted and another with the same name is created, the new hub is assigned a different unique_id.
+      &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time the hub was last updated.
+    },
+  ],
+  &quot;nextPageToken&quot;: &quot;A String&quot;, # The next pagination token in the List response. It should be used as page_token for the following request. An empty value means no more result.
+  &quot;unreachable&quot;: [ # Locations that could not be reached.
+    &quot;A String&quot;,
+  ],
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list_next">list_next(previous_request, previous_response)</code>
+  <pre>Retrieves the next page of results.
+
+Args:
+  previous_request: The request for the previous page. (required)
+  previous_response: The response from the request for the previous page. (required)
+
+Returns:
+  A request object that you can call &#x27;execute()&#x27; on to request the next
+  page. Returns None if there are no more items in the collection.
+    </pre>
+</div>
+
+<div class="method">
+    <code class="details" id="patch">patch(name, body=None, requestId=None, updateMask=None, x__xgafv=None)</code>
+  <pre>Updates the description and/or labels of the specified hub.
+
+Args:
+  name: string, Immutable. The name of the hub. Hub names must be unique. They use the following form: `projects/{project_number}/locations/global/hubs/{hub_id}` (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # A hub is a collection of spokes. A single hub can contain spokes from multiple regions. However, all of a hub&#x27;s spokes must be associated with resources that reside in the same VPC network.
+  &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time the hub was created.
+  &quot;description&quot;: &quot;A String&quot;, # An optional description of the hub.
+  &quot;labels&quot;: { # Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements).
+    &quot;a_key&quot;: &quot;A String&quot;,
+  },
+  &quot;name&quot;: &quot;A String&quot;, # Immutable. The name of the hub. Hub names must be unique. They use the following form: `projects/{project_number}/locations/global/hubs/{hub_id}`
+  &quot;routingVpcs&quot;: [ # The VPC network associated with this hub&#x27;s spokes. All of the VPN tunnels, VLAN attachments, and router appliance instances referenced by this hub&#x27;s spokes must belong to this VPC network. This field is read-only. Network Connectivity Center automatically populates it based on the set of spokes attached to the hub.
+    { # RoutingVPC contains information about the VPC network that is associated with a hub&#x27;s spokes.
+      &quot;uri&quot;: &quot;A String&quot;, # The URI of the VPC network.
+    },
+  ],
+  &quot;state&quot;: &quot;A String&quot;, # Output only. The current lifecycle state of this hub.
+  &quot;uniqueId&quot;: &quot;A String&quot;, # Output only. The Google-generated UUID for the hub. This value is unique across all hub resources. If a hub is deleted and another with the same name is created, the new hub is assigned a different unique_id.
+  &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time the hub was last updated.
+}
+
+  requestId: string, Optional. A unique request ID (optional). If you specify this ID, you can use it in cases when you need to retry your request. When you need to retry, this ID lets the server know that it can ignore the request if it has already been completed. The server guarantees that for at least 60 minutes after the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check to see whether the original operation was received. If it was, the server ignores the second request. This behavior prevents clients from mistakenly creating duplicate commitments. The request ID must be a valid UUID, with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
+  updateMask: string, Optional. In the case of an update to an existing hub, field mask is used to specify the fields to be overwritten. The fields specified in the update_mask are relative to the resource, not the full request. A field is overwritten if it is in the mask. If the user does not provide a mask, then all fields are overwritten.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # This resource represents a long-running operation that is the result of a network API call.
+  &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+  &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+    &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+      {
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    ],
+    &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+  },
+  &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+  &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>
+  <pre>Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.
+
+Args:
+  resource: string, REQUIRED: The resource for which the policy is being specified. See the operation documentation for the appropriate value for this field. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Request message for `SetIamPolicy` method.
+  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+    &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
+      { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
+        &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
+          { # Provides the configuration for logging a type of permissions. Example: { &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; } ] } This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting jose@example.com from DATA_READ logging.
+            &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+              &quot;A String&quot;,
+            ],
+            &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
+          },
+        ],
+        &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+      },
+    ],
+    &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+      { # Associates `members` with a `role`.
+        &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+          &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+          &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
+          &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+          &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+        },
+        &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+          &quot;A String&quot;,
+        ],
+        &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+      },
+    ],
+    &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+    &quot;version&quot;: 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+  },
+  &quot;updateMask&quot;: &quot;A String&quot;, # OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only the fields in the mask will be modified. If no mask is provided, the following default mask is used: `paths: &quot;bindings, etag&quot;`
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+  &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
+    { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
+      &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
+        { # Provides the configuration for logging a type of permissions. Example: { &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; } ] } This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting jose@example.com from DATA_READ logging.
+          &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+            &quot;A String&quot;,
+          ],
+          &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
+        },
+      ],
+      &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+    },
+  ],
+  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+    { # Associates `members` with a `role`.
+      &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+        &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+        &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
+        &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+        &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+      },
+      &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+        &quot;A String&quot;,
+      ],
+      &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+    },
+  ],
+  &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+  &quot;version&quot;: 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>
+  <pre>Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may &quot;fail open&quot; without warning.
+
+Args:
+  resource: string, REQUIRED: The resource for which the policy detail is being requested. See the operation documentation for the appropriate value for this field. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Request message for `TestIamPermissions` method.
+  &quot;permissions&quot;: [ # The set of permissions to check for the `resource`. Permissions with wildcards (such as &#x27;*&#x27; or &#x27;storage.*&#x27;) are not allowed. For more information see [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).
+    &quot;A String&quot;,
+  ],
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Response message for `TestIamPermissions` method.
+  &quot;permissions&quot;: [ # A subset of `TestPermissionsRequest.permissions` that the caller is allowed.
+    &quot;A String&quot;,
+  ],
+}</pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/networkconnectivity_v1.projects.locations.global_.policyBasedRoutes.html b/docs/dyn/networkconnectivity_v1.projects.locations.global_.policyBasedRoutes.html
new file mode 100644
index 0000000..e2dbac3
--- /dev/null
+++ b/docs/dyn/networkconnectivity_v1.projects.locations.global_.policyBasedRoutes.html
@@ -0,0 +1,258 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="networkconnectivity_v1.html">Network Connectivity API</a> . <a href="networkconnectivity_v1.projects.html">projects</a> . <a href="networkconnectivity_v1.projects.locations.html">locations</a> . <a href="networkconnectivity_v1.projects.locations.global_.html">global_</a> . <a href="networkconnectivity_v1.projects.locations.global_.policyBasedRoutes.html">policyBasedRoutes</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.</p>
+<p class="toc_element">
+  <code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.</p>
+<p class="toc_element">
+  <code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may "fail open" without warning.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</code>
+  <pre>Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.
+
+Args:
+  resource: string, REQUIRED: The resource for which the policy is being requested. See the operation documentation for the appropriate value for this field. (required)
+  options_requestedPolicyVersion: integer, Optional. The policy format version to be returned. Valid values are 0, 1, and 3. Requests specifying an invalid value will be rejected. Requests for policies with any conditional bindings must specify version 3. Policies without any conditional bindings may specify any valid value or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+  &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
+    { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
+      &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
+        { # Provides the configuration for logging a type of permissions. Example: { &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; } ] } This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting jose@example.com from DATA_READ logging.
+          &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+            &quot;A String&quot;,
+          ],
+          &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
+        },
+      ],
+      &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+    },
+  ],
+  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+    { # Associates `members` with a `role`.
+      &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+        &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+        &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
+        &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+        &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+      },
+      &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+        &quot;A String&quot;,
+      ],
+      &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+    },
+  ],
+  &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+  &quot;version&quot;: 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>
+  <pre>Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.
+
+Args:
+  resource: string, REQUIRED: The resource for which the policy is being specified. See the operation documentation for the appropriate value for this field. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Request message for `SetIamPolicy` method.
+  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+    &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
+      { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
+        &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
+          { # Provides the configuration for logging a type of permissions. Example: { &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; } ] } This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting jose@example.com from DATA_READ logging.
+            &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+              &quot;A String&quot;,
+            ],
+            &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
+          },
+        ],
+        &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+      },
+    ],
+    &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+      { # Associates `members` with a `role`.
+        &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+          &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+          &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
+          &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+          &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+        },
+        &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+          &quot;A String&quot;,
+        ],
+        &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+      },
+    ],
+    &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+    &quot;version&quot;: 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+  },
+  &quot;updateMask&quot;: &quot;A String&quot;, # OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only the fields in the mask will be modified. If no mask is provided, the following default mask is used: `paths: &quot;bindings, etag&quot;`
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+  &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
+    { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
+      &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
+        { # Provides the configuration for logging a type of permissions. Example: { &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; } ] } This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting jose@example.com from DATA_READ logging.
+          &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+            &quot;A String&quot;,
+          ],
+          &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
+        },
+      ],
+      &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+    },
+  ],
+  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+    { # Associates `members` with a `role`.
+      &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+        &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+        &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
+        &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+        &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+      },
+      &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+        &quot;A String&quot;,
+      ],
+      &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+    },
+  ],
+  &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+  &quot;version&quot;: 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>
+  <pre>Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may &quot;fail open&quot; without warning.
+
+Args:
+  resource: string, REQUIRED: The resource for which the policy detail is being requested. See the operation documentation for the appropriate value for this field. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Request message for `TestIamPermissions` method.
+  &quot;permissions&quot;: [ # The set of permissions to check for the `resource`. Permissions with wildcards (such as &#x27;*&#x27; or &#x27;storage.*&#x27;) are not allowed. For more information see [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).
+    &quot;A String&quot;,
+  ],
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Response message for `TestIamPermissions` method.
+  &quot;permissions&quot;: [ # A subset of `TestPermissionsRequest.permissions` that the caller is allowed.
+    &quot;A String&quot;,
+  ],
+}</pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/networkconnectivity_v1.projects.locations.html b/docs/dyn/networkconnectivity_v1.projects.locations.html
new file mode 100644
index 0000000..ae8337d
--- /dev/null
+++ b/docs/dyn/networkconnectivity_v1.projects.locations.html
@@ -0,0 +1,186 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="networkconnectivity_v1.html">Network Connectivity API</a> . <a href="networkconnectivity_v1.projects.html">projects</a> . <a href="networkconnectivity_v1.projects.locations.html">locations</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="networkconnectivity_v1.projects.locations.global_.html">global_()</a></code>
+</p>
+<p class="firstline">Returns the global_ Resource.</p>
+
+<p class="toc_element">
+  <code><a href="networkconnectivity_v1.projects.locations.operations.html">operations()</a></code>
+</p>
+<p class="firstline">Returns the operations Resource.</p>
+
+<p class="toc_element">
+  <code><a href="networkconnectivity_v1.projects.locations.spokes.html">spokes()</a></code>
+</p>
+<p class="firstline">Returns the spokes Resource.</p>
+
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets information about a location.</p>
+<p class="toc_element">
+  <code><a href="#list">list(name, filter=None, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Lists information about the supported locations for this service.</p>
+<p class="toc_element">
+  <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
+<p class="firstline">Retrieves the next page of results.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="get">get(name, x__xgafv=None)</code>
+  <pre>Gets information about a location.
+
+Args:
+  name: string, Resource name for the location. (required)
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # A resource that represents Google Cloud Platform location.
+  &quot;displayName&quot;: &quot;A String&quot;, # The friendly name for this location, typically a nearby city name. For example, &quot;Tokyo&quot;.
+  &quot;labels&quot;: { # Cross-service attributes for the location. For example {&quot;cloud.googleapis.com/region&quot;: &quot;us-east1&quot;}
+    &quot;a_key&quot;: &quot;A String&quot;,
+  },
+  &quot;locationId&quot;: &quot;A String&quot;, # The canonical id for this location. For example: `&quot;us-east1&quot;`.
+  &quot;metadata&quot;: { # Service-specific metadata. For example the available capacity at the given location.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # Resource name for the location, which may vary between implementations. For example: `&quot;projects/example-project/locations/us-east1&quot;`
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list">list(name, filter=None, pageSize=None, pageToken=None, x__xgafv=None)</code>
+  <pre>Lists information about the supported locations for this service.
+
+Args:
+  name: string, The resource that owns the locations collection, if applicable. (required)
+  filter: string, A filter to narrow down results to a preferred subset. The filtering language accepts strings like &quot;displayName=tokyo&quot;, and is documented in more detail in [AIP-160](https://google.aip.dev/160).
+  pageSize: integer, The maximum number of results to return. If not set, the service selects a default.
+  pageToken: string, A page token received from the `next_page_token` field in the response. Send that page token to receive the subsequent page.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # The response message for Locations.ListLocations.
+  &quot;locations&quot;: [ # A list of locations that matches the specified filter in the request.
+    { # A resource that represents Google Cloud Platform location.
+      &quot;displayName&quot;: &quot;A String&quot;, # The friendly name for this location, typically a nearby city name. For example, &quot;Tokyo&quot;.
+      &quot;labels&quot;: { # Cross-service attributes for the location. For example {&quot;cloud.googleapis.com/region&quot;: &quot;us-east1&quot;}
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+      &quot;locationId&quot;: &quot;A String&quot;, # The canonical id for this location. For example: `&quot;us-east1&quot;`.
+      &quot;metadata&quot;: { # Service-specific metadata. For example the available capacity at the given location.
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+      &quot;name&quot;: &quot;A String&quot;, # Resource name for the location, which may vary between implementations. For example: `&quot;projects/example-project/locations/us-east1&quot;`
+    },
+  ],
+  &quot;nextPageToken&quot;: &quot;A String&quot;, # The standard List next-page token.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list_next">list_next(previous_request, previous_response)</code>
+  <pre>Retrieves the next page of results.
+
+Args:
+  previous_request: The request for the previous page. (required)
+  previous_response: The response from the request for the previous page. (required)
+
+Returns:
+  A request object that you can call &#x27;execute()&#x27; on to request the next
+  page. Returns None if there are no more items in the collection.
+    </pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/networkconnectivity_v1.projects.locations.operations.html b/docs/dyn/networkconnectivity_v1.projects.locations.operations.html
new file mode 100644
index 0000000..24d24d2
--- /dev/null
+++ b/docs/dyn/networkconnectivity_v1.projects.locations.operations.html
@@ -0,0 +1,235 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="networkconnectivity_v1.html">Network Connectivity API</a> . <a href="networkconnectivity_v1.projects.html">projects</a> . <a href="networkconnectivity_v1.projects.locations.html">locations</a> . <a href="networkconnectivity_v1.projects.locations.operations.html">operations</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="#cancel">cancel(name, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Starts asynchronous cancellation on a long-running operation. The server makes a best effort to cancel the operation, but success is not guaranteed. If the server doesn't support this method, it returns `google.rpc.Code.UNIMPLEMENTED`. Clients can use Operations.GetOperation or other methods to check whether the cancellation succeeded or whether the operation completed despite cancellation. On successful cancellation, the operation is not deleted; instead, it becomes an operation with an Operation.error value with a google.rpc.Status.code of 1, corresponding to `Code.CANCELLED`.</p>
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>
+<p class="firstline">Deletes a long-running operation. This method indicates that the client is no longer interested in the operation result. It does not cancel the operation. If the server doesn't support this method, it returns `google.rpc.Code.UNIMPLEMENTED`.</p>
+<p class="toc_element">
+  <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets the latest state of a long-running operation. Clients can use this method to poll the operation result at intervals as recommended by the API service.</p>
+<p class="toc_element">
+  <code><a href="#list">list(name, filter=None, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Lists operations that match the specified filter in the request. If the server doesn't support this method, it returns `UNIMPLEMENTED`. NOTE: the `name` binding allows API services to override the binding to use different resource name schemes, such as `users/*/operations`. To override the binding, API services can add a binding such as `"/v1/{name=users/*}/operations"` to their service configuration. For backwards compatibility, the default name includes the operations collection id, however overriding users must ensure the name binding is the parent resource, without the operations collection id.</p>
+<p class="toc_element">
+  <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
+<p class="firstline">Retrieves the next page of results.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="cancel">cancel(name, body=None, x__xgafv=None)</code>
+  <pre>Starts asynchronous cancellation on a long-running operation. The server makes a best effort to cancel the operation, but success is not guaranteed. If the server doesn&#x27;t support this method, it returns `google.rpc.Code.UNIMPLEMENTED`. Clients can use Operations.GetOperation or other methods to check whether the cancellation succeeded or whether the operation completed despite cancellation. On successful cancellation, the operation is not deleted; instead, it becomes an operation with an Operation.error value with a google.rpc.Status.code of 1, corresponding to `Code.CANCELLED`.
+
+Args:
+  name: string, The name of the operation resource to be cancelled. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # The request message for Operations.CancelOperation.
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); } The JSON representation for `Empty` is empty JSON object `{}`.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="delete">delete(name, x__xgafv=None)</code>
+  <pre>Deletes a long-running operation. This method indicates that the client is no longer interested in the operation result. It does not cancel the operation. If the server doesn&#x27;t support this method, it returns `google.rpc.Code.UNIMPLEMENTED`.
+
+Args:
+  name: string, The name of the operation resource to be deleted. (required)
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); } The JSON representation for `Empty` is empty JSON object `{}`.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="get">get(name, x__xgafv=None)</code>
+  <pre>Gets the latest state of a long-running operation. Clients can use this method to poll the operation result at intervals as recommended by the API service.
+
+Args:
+  name: string, The name of the operation resource. (required)
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # This resource represents a long-running operation that is the result of a network API call.
+  &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+  &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+    &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+      {
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    ],
+    &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+  },
+  &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+  &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list">list(name, filter=None, pageSize=None, pageToken=None, x__xgafv=None)</code>
+  <pre>Lists operations that match the specified filter in the request. If the server doesn&#x27;t support this method, it returns `UNIMPLEMENTED`. NOTE: the `name` binding allows API services to override the binding to use different resource name schemes, such as `users/*/operations`. To override the binding, API services can add a binding such as `&quot;/v1/{name=users/*}/operations&quot;` to their service configuration. For backwards compatibility, the default name includes the operations collection id, however overriding users must ensure the name binding is the parent resource, without the operations collection id.
+
+Args:
+  name: string, The name of the operation&#x27;s parent resource. (required)
+  filter: string, The standard list filter.
+  pageSize: integer, The standard list page size.
+  pageToken: string, The standard list page token.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # The response message for Operations.ListOperations.
+  &quot;nextPageToken&quot;: &quot;A String&quot;, # The standard List next-page token.
+  &quot;operations&quot;: [ # A list of operations that matches the specified filter in the request.
+    { # This resource represents a long-running operation that is the result of a network API call.
+      &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+      &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+        &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+        &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+          {
+            &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+          },
+        ],
+        &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+      },
+      &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+      &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+      &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    },
+  ],
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list_next">list_next(previous_request, previous_response)</code>
+  <pre>Retrieves the next page of results.
+
+Args:
+  previous_request: The request for the previous page. (required)
+  previous_response: The response from the request for the previous page. (required)
+
+Returns:
+  A request object that you can call &#x27;execute()&#x27; on to request the next
+  page. Returns None if there are no more items in the collection.
+    </pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/networkconnectivity_v1.projects.locations.spokes.html b/docs/dyn/networkconnectivity_v1.projects.locations.spokes.html
new file mode 100644
index 0000000..538d47e
--- /dev/null
+++ b/docs/dyn/networkconnectivity_v1.projects.locations.spokes.html
@@ -0,0 +1,584 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="networkconnectivity_v1.html">Network Connectivity API</a> . <a href="networkconnectivity_v1.projects.html">projects</a> . <a href="networkconnectivity_v1.projects.locations.html">locations</a> . <a href="networkconnectivity_v1.projects.locations.spokes.html">spokes</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#create">create(parent, body=None, requestId=None, spokeId=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Creates a spoke in the specified project and location.</p>
+<p class="toc_element">
+  <code><a href="#delete">delete(name, requestId=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Deletes the specified spoke.</p>
+<p class="toc_element">
+  <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets details about the specified spoke.</p>
+<p class="toc_element">
+  <code><a href="#getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.</p>
+<p class="toc_element">
+  <code><a href="#list">list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Lists the spokes in the specified project and location.</p>
+<p class="toc_element">
+  <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
+<p class="firstline">Retrieves the next page of results.</p>
+<p class="toc_element">
+  <code><a href="#patch">patch(name, body=None, requestId=None, updateMask=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Updates the parameters of the specified spoke.</p>
+<p class="toc_element">
+  <code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.</p>
+<p class="toc_element">
+  <code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may "fail open" without warning.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="create">create(parent, body=None, requestId=None, spokeId=None, x__xgafv=None)</code>
+  <pre>Creates a spoke in the specified project and location.
+
+Args:
+  parent: string, Required. The parent resource. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # A spoke represents a connection between your Google Cloud network resources and a non-Google-Cloud network. When you create a spoke, you associate it with a hub. You must also identify a value for exactly one of the following fields: * linked_vpn_tunnels * linked_interconnect_attachments * linked_router_appliance_instances
+  &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time the spoke was created.
+  &quot;description&quot;: &quot;A String&quot;, # An optional description of the spoke.
+  &quot;hub&quot;: &quot;A String&quot;, # Immutable. The URI of the hub that this spoke is attached to.
+  &quot;labels&quot;: { # Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements).
+    &quot;a_key&quot;: &quot;A String&quot;,
+  },
+  &quot;linkedInterconnectAttachments&quot;: { # A collection of VLAN attachment resources. These resources should be redundant attachments that all advertise the same prefixes to Google Cloud. Alternatively, in active/passive configurations, all attachments should be capable of advertising the same prefixes. # VLAN attachments that are associated with the spoke.
+    &quot;siteToSiteDataTransfer&quot;: True or False, # A value that controls whether site-to-site data transfer is enabled for these resources. This field is set to false by default, but you must set it to true. Note that data transfer is available only in supported locations.
+    &quot;uris&quot;: [ # The URIs of linked interconnect attachment resources
+      &quot;A String&quot;,
+    ],
+  },
+  &quot;linkedRouterApplianceInstances&quot;: { # A collection of router appliance instances. If you have multiple router appliance instances connected to the same site, they should all be attached to the same spoke. # Router appliance instances that are associated with the spoke.
+    &quot;instances&quot;: [ # The list of router appliance instances.
+      { # A router appliance instance is a Compute Engine virtual machine (VM) instance that acts as a BGP speaker. A router appliance instance is specified by the URI of the VM and the internal IP address of one of the VM&#x27;s network interfaces.
+        &quot;ipAddress&quot;: &quot;A String&quot;, # The IP address on the VM to use for peering.
+        &quot;virtualMachine&quot;: &quot;A String&quot;, # The URI of the VM.
+      },
+    ],
+    &quot;siteToSiteDataTransfer&quot;: True or False, # A value that controls whether site-to-site data transfer is enabled for these resources. This field is set to false by default, but you must set it to true. Note that data transfer is available only in supported locations.
+  },
+  &quot;linkedVpnTunnels&quot;: { # A collection of Cloud VPN tunnel resources. These resources should be redundant HA VPN tunnels that all advertise the same prefixes to Google Cloud. Alternatively, in a passive/active configuration, all tunnels should be capable of advertising the same prefixes. # VPN tunnels that are associated with the spoke.
+    &quot;siteToSiteDataTransfer&quot;: True or False, # A value that controls whether site-to-site data transfer is enabled for these resources. This field is set to false by default, but you must set it to true. Note that data transfer is available only in supported locations.
+    &quot;uris&quot;: [ # The URIs of linked VPN tunnel resources.
+      &quot;A String&quot;,
+    ],
+  },
+  &quot;name&quot;: &quot;A String&quot;, # Immutable. The name of the spoke. Spoke names must be unique. They use the following form: `projects/{project_number}/locations/{region}/spokes/{spoke_id}`
+  &quot;state&quot;: &quot;A String&quot;, # Output only. The current lifecycle state of this spoke.
+  &quot;uniqueId&quot;: &quot;A String&quot;, # Output only. The Google-generated UUID for the spoke. This value is unique across all spoke resources. If a spoke is deleted and another with the same name is created, the new spoke is assigned a different unique_id.
+  &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time the spoke was last updated.
+}
+
+  requestId: string, Optional. A unique request ID (optional). If you specify this ID, you can use it in cases when you need to retry your request. When you need to retry, this ID lets the server know that it can ignore the request if it has already been completed. The server guarantees that for at least 60 minutes after the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check to see whether the original operation was received. If it was, the server ignores the second request. This behavior prevents clients from mistakenly creating duplicate commitments. The request ID must be a valid UUID, with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
+  spokeId: string, Optional. Unique id for the spoke to create.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # This resource represents a long-running operation that is the result of a network API call.
+  &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+  &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+    &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+      {
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    ],
+    &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+  },
+  &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+  &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="delete">delete(name, requestId=None, x__xgafv=None)</code>
+  <pre>Deletes the specified spoke.
+
+Args:
+  name: string, Required. The name of the spoke to delete. (required)
+  requestId: string, Optional. A unique request ID (optional). If you specify this ID, you can use it in cases when you need to retry your request. When you need to retry, this ID lets the server know that it can ignore the request if it has already been completed. The server guarantees that for at least 60 minutes after the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check to see whether the original operation was received. If it was, the server ignores the second request. This behavior prevents clients from mistakenly creating duplicate commitments. The request ID must be a valid UUID, with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # This resource represents a long-running operation that is the result of a network API call.
+  &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+  &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+    &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+      {
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    ],
+    &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+  },
+  &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+  &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="get">get(name, x__xgafv=None)</code>
+  <pre>Gets details about the specified spoke.
+
+Args:
+  name: string, Required. The name of the spoke resource. (required)
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # A spoke represents a connection between your Google Cloud network resources and a non-Google-Cloud network. When you create a spoke, you associate it with a hub. You must also identify a value for exactly one of the following fields: * linked_vpn_tunnels * linked_interconnect_attachments * linked_router_appliance_instances
+  &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time the spoke was created.
+  &quot;description&quot;: &quot;A String&quot;, # An optional description of the spoke.
+  &quot;hub&quot;: &quot;A String&quot;, # Immutable. The URI of the hub that this spoke is attached to.
+  &quot;labels&quot;: { # Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements).
+    &quot;a_key&quot;: &quot;A String&quot;,
+  },
+  &quot;linkedInterconnectAttachments&quot;: { # A collection of VLAN attachment resources. These resources should be redundant attachments that all advertise the same prefixes to Google Cloud. Alternatively, in active/passive configurations, all attachments should be capable of advertising the same prefixes. # VLAN attachments that are associated with the spoke.
+    &quot;siteToSiteDataTransfer&quot;: True or False, # A value that controls whether site-to-site data transfer is enabled for these resources. This field is set to false by default, but you must set it to true. Note that data transfer is available only in supported locations.
+    &quot;uris&quot;: [ # The URIs of linked interconnect attachment resources
+      &quot;A String&quot;,
+    ],
+  },
+  &quot;linkedRouterApplianceInstances&quot;: { # A collection of router appliance instances. If you have multiple router appliance instances connected to the same site, they should all be attached to the same spoke. # Router appliance instances that are associated with the spoke.
+    &quot;instances&quot;: [ # The list of router appliance instances.
+      { # A router appliance instance is a Compute Engine virtual machine (VM) instance that acts as a BGP speaker. A router appliance instance is specified by the URI of the VM and the internal IP address of one of the VM&#x27;s network interfaces.
+        &quot;ipAddress&quot;: &quot;A String&quot;, # The IP address on the VM to use for peering.
+        &quot;virtualMachine&quot;: &quot;A String&quot;, # The URI of the VM.
+      },
+    ],
+    &quot;siteToSiteDataTransfer&quot;: True or False, # A value that controls whether site-to-site data transfer is enabled for these resources. This field is set to false by default, but you must set it to true. Note that data transfer is available only in supported locations.
+  },
+  &quot;linkedVpnTunnels&quot;: { # A collection of Cloud VPN tunnel resources. These resources should be redundant HA VPN tunnels that all advertise the same prefixes to Google Cloud. Alternatively, in a passive/active configuration, all tunnels should be capable of advertising the same prefixes. # VPN tunnels that are associated with the spoke.
+    &quot;siteToSiteDataTransfer&quot;: True or False, # A value that controls whether site-to-site data transfer is enabled for these resources. This field is set to false by default, but you must set it to true. Note that data transfer is available only in supported locations.
+    &quot;uris&quot;: [ # The URIs of linked VPN tunnel resources.
+      &quot;A String&quot;,
+    ],
+  },
+  &quot;name&quot;: &quot;A String&quot;, # Immutable. The name of the spoke. Spoke names must be unique. They use the following form: `projects/{project_number}/locations/{region}/spokes/{spoke_id}`
+  &quot;state&quot;: &quot;A String&quot;, # Output only. The current lifecycle state of this spoke.
+  &quot;uniqueId&quot;: &quot;A String&quot;, # Output only. The Google-generated UUID for the spoke. This value is unique across all spoke resources. If a spoke is deleted and another with the same name is created, the new spoke is assigned a different unique_id.
+  &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time the spoke was last updated.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</code>
+  <pre>Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.
+
+Args:
+  resource: string, REQUIRED: The resource for which the policy is being requested. See the operation documentation for the appropriate value for this field. (required)
+  options_requestedPolicyVersion: integer, Optional. The policy format version to be returned. Valid values are 0, 1, and 3. Requests specifying an invalid value will be rejected. Requests for policies with any conditional bindings must specify version 3. Policies without any conditional bindings may specify any valid value or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+  &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
+    { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
+      &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
+        { # Provides the configuration for logging a type of permissions. Example: { &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; } ] } This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting jose@example.com from DATA_READ logging.
+          &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+            &quot;A String&quot;,
+          ],
+          &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
+        },
+      ],
+      &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+    },
+  ],
+  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+    { # Associates `members` with a `role`.
+      &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+        &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+        &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
+        &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+        &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+      },
+      &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+        &quot;A String&quot;,
+      ],
+      &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+    },
+  ],
+  &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+  &quot;version&quot;: 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list">list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, x__xgafv=None)</code>
+  <pre>Lists the spokes in the specified project and location.
+
+Args:
+  parent: string, Required. The parent resource. (required)
+  filter: string, An expression that filters the results listed in the response.
+  orderBy: string, Sort the results by a certain order.
+  pageSize: integer, The maximum number of results per page that should be returned.
+  pageToken: string, The page token.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # The response for HubService.ListSpokes.
+  &quot;nextPageToken&quot;: &quot;A String&quot;, # The next pagination token in the List response. It should be used as page_token for the following request. An empty value means no more result.
+  &quot;spokes&quot;: [ # The requested spokes.
+    { # A spoke represents a connection between your Google Cloud network resources and a non-Google-Cloud network. When you create a spoke, you associate it with a hub. You must also identify a value for exactly one of the following fields: * linked_vpn_tunnels * linked_interconnect_attachments * linked_router_appliance_instances
+      &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time the spoke was created.
+      &quot;description&quot;: &quot;A String&quot;, # An optional description of the spoke.
+      &quot;hub&quot;: &quot;A String&quot;, # Immutable. The URI of the hub that this spoke is attached to.
+      &quot;labels&quot;: { # Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements).
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+      &quot;linkedInterconnectAttachments&quot;: { # A collection of VLAN attachment resources. These resources should be redundant attachments that all advertise the same prefixes to Google Cloud. Alternatively, in active/passive configurations, all attachments should be capable of advertising the same prefixes. # VLAN attachments that are associated with the spoke.
+        &quot;siteToSiteDataTransfer&quot;: True or False, # A value that controls whether site-to-site data transfer is enabled for these resources. This field is set to false by default, but you must set it to true. Note that data transfer is available only in supported locations.
+        &quot;uris&quot;: [ # The URIs of linked interconnect attachment resources
+          &quot;A String&quot;,
+        ],
+      },
+      &quot;linkedRouterApplianceInstances&quot;: { # A collection of router appliance instances. If you have multiple router appliance instances connected to the same site, they should all be attached to the same spoke. # Router appliance instances that are associated with the spoke.
+        &quot;instances&quot;: [ # The list of router appliance instances.
+          { # A router appliance instance is a Compute Engine virtual machine (VM) instance that acts as a BGP speaker. A router appliance instance is specified by the URI of the VM and the internal IP address of one of the VM&#x27;s network interfaces.
+            &quot;ipAddress&quot;: &quot;A String&quot;, # The IP address on the VM to use for peering.
+            &quot;virtualMachine&quot;: &quot;A String&quot;, # The URI of the VM.
+          },
+        ],
+        &quot;siteToSiteDataTransfer&quot;: True or False, # A value that controls whether site-to-site data transfer is enabled for these resources. This field is set to false by default, but you must set it to true. Note that data transfer is available only in supported locations.
+      },
+      &quot;linkedVpnTunnels&quot;: { # A collection of Cloud VPN tunnel resources. These resources should be redundant HA VPN tunnels that all advertise the same prefixes to Google Cloud. Alternatively, in a passive/active configuration, all tunnels should be capable of advertising the same prefixes. # VPN tunnels that are associated with the spoke.
+        &quot;siteToSiteDataTransfer&quot;: True or False, # A value that controls whether site-to-site data transfer is enabled for these resources. This field is set to false by default, but you must set it to true. Note that data transfer is available only in supported locations.
+        &quot;uris&quot;: [ # The URIs of linked VPN tunnel resources.
+          &quot;A String&quot;,
+        ],
+      },
+      &quot;name&quot;: &quot;A String&quot;, # Immutable. The name of the spoke. Spoke names must be unique. They use the following form: `projects/{project_number}/locations/{region}/spokes/{spoke_id}`
+      &quot;state&quot;: &quot;A String&quot;, # Output only. The current lifecycle state of this spoke.
+      &quot;uniqueId&quot;: &quot;A String&quot;, # Output only. The Google-generated UUID for the spoke. This value is unique across all spoke resources. If a spoke is deleted and another with the same name is created, the new spoke is assigned a different unique_id.
+      &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time the spoke was last updated.
+    },
+  ],
+  &quot;unreachable&quot;: [ # Locations that could not be reached.
+    &quot;A String&quot;,
+  ],
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list_next">list_next(previous_request, previous_response)</code>
+  <pre>Retrieves the next page of results.
+
+Args:
+  previous_request: The request for the previous page. (required)
+  previous_response: The response from the request for the previous page. (required)
+
+Returns:
+  A request object that you can call &#x27;execute()&#x27; on to request the next
+  page. Returns None if there are no more items in the collection.
+    </pre>
+</div>
+
+<div class="method">
+    <code class="details" id="patch">patch(name, body=None, requestId=None, updateMask=None, x__xgafv=None)</code>
+  <pre>Updates the parameters of the specified spoke.
+
+Args:
+  name: string, Immutable. The name of the spoke. Spoke names must be unique. They use the following form: `projects/{project_number}/locations/{region}/spokes/{spoke_id}` (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # A spoke represents a connection between your Google Cloud network resources and a non-Google-Cloud network. When you create a spoke, you associate it with a hub. You must also identify a value for exactly one of the following fields: * linked_vpn_tunnels * linked_interconnect_attachments * linked_router_appliance_instances
+  &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time the spoke was created.
+  &quot;description&quot;: &quot;A String&quot;, # An optional description of the spoke.
+  &quot;hub&quot;: &quot;A String&quot;, # Immutable. The URI of the hub that this spoke is attached to.
+  &quot;labels&quot;: { # Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements).
+    &quot;a_key&quot;: &quot;A String&quot;,
+  },
+  &quot;linkedInterconnectAttachments&quot;: { # A collection of VLAN attachment resources. These resources should be redundant attachments that all advertise the same prefixes to Google Cloud. Alternatively, in active/passive configurations, all attachments should be capable of advertising the same prefixes. # VLAN attachments that are associated with the spoke.
+    &quot;siteToSiteDataTransfer&quot;: True or False, # A value that controls whether site-to-site data transfer is enabled for these resources. This field is set to false by default, but you must set it to true. Note that data transfer is available only in supported locations.
+    &quot;uris&quot;: [ # The URIs of linked interconnect attachment resources
+      &quot;A String&quot;,
+    ],
+  },
+  &quot;linkedRouterApplianceInstances&quot;: { # A collection of router appliance instances. If you have multiple router appliance instances connected to the same site, they should all be attached to the same spoke. # Router appliance instances that are associated with the spoke.
+    &quot;instances&quot;: [ # The list of router appliance instances.
+      { # A router appliance instance is a Compute Engine virtual machine (VM) instance that acts as a BGP speaker. A router appliance instance is specified by the URI of the VM and the internal IP address of one of the VM&#x27;s network interfaces.
+        &quot;ipAddress&quot;: &quot;A String&quot;, # The IP address on the VM to use for peering.
+        &quot;virtualMachine&quot;: &quot;A String&quot;, # The URI of the VM.
+      },
+    ],
+    &quot;siteToSiteDataTransfer&quot;: True or False, # A value that controls whether site-to-site data transfer is enabled for these resources. This field is set to false by default, but you must set it to true. Note that data transfer is available only in supported locations.
+  },
+  &quot;linkedVpnTunnels&quot;: { # A collection of Cloud VPN tunnel resources. These resources should be redundant HA VPN tunnels that all advertise the same prefixes to Google Cloud. Alternatively, in a passive/active configuration, all tunnels should be capable of advertising the same prefixes. # VPN tunnels that are associated with the spoke.
+    &quot;siteToSiteDataTransfer&quot;: True or False, # A value that controls whether site-to-site data transfer is enabled for these resources. This field is set to false by default, but you must set it to true. Note that data transfer is available only in supported locations.
+    &quot;uris&quot;: [ # The URIs of linked VPN tunnel resources.
+      &quot;A String&quot;,
+    ],
+  },
+  &quot;name&quot;: &quot;A String&quot;, # Immutable. The name of the spoke. Spoke names must be unique. They use the following form: `projects/{project_number}/locations/{region}/spokes/{spoke_id}`
+  &quot;state&quot;: &quot;A String&quot;, # Output only. The current lifecycle state of this spoke.
+  &quot;uniqueId&quot;: &quot;A String&quot;, # Output only. The Google-generated UUID for the spoke. This value is unique across all spoke resources. If a spoke is deleted and another with the same name is created, the new spoke is assigned a different unique_id.
+  &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The time the spoke was last updated.
+}
+
+  requestId: string, Optional. A unique request ID (optional). If you specify this ID, you can use it in cases when you need to retry your request. When you need to retry, this ID lets the server know that it can ignore the request if it has already been completed. The server guarantees that for at least 60 minutes after the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check to see whether the original operation was received. If it was, the server ignores the second request. This behavior prevents clients from mistakenly creating duplicate commitments. The request ID must be a valid UUID, with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
+  updateMask: string, Optional. In the case of an update to an existing spoke, field mask is used to specify the fields to be overwritten. The fields specified in the update_mask are relative to the resource, not the full request. A field is overwritten if it is in the mask. If the user does not provide a mask, then all fields are overwritten.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # This resource represents a long-running operation that is the result of a network API call.
+  &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+  &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+    &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+      {
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    ],
+    &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+  },
+  &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+  &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>
+  <pre>Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.
+
+Args:
+  resource: string, REQUIRED: The resource for which the policy is being specified. See the operation documentation for the appropriate value for this field. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Request message for `SetIamPolicy` method.
+  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+    &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
+      { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
+        &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
+          { # Provides the configuration for logging a type of permissions. Example: { &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; } ] } This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting jose@example.com from DATA_READ logging.
+            &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+              &quot;A String&quot;,
+            ],
+            &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
+          },
+        ],
+        &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+      },
+    ],
+    &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+      { # Associates `members` with a `role`.
+        &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+          &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+          &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
+          &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+          &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+        },
+        &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+          &quot;A String&quot;,
+        ],
+        &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+      },
+    ],
+    &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+    &quot;version&quot;: 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+  },
+  &quot;updateMask&quot;: &quot;A String&quot;, # OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only the fields in the mask will be modified. If no mask is provided, the following default mask is used: `paths: &quot;bindings, etag&quot;`
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+  &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
+    { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
+      &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
+        { # Provides the configuration for logging a type of permissions. Example: { &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; } ] } This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting jose@example.com from DATA_READ logging.
+          &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+            &quot;A String&quot;,
+          ],
+          &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
+        },
+      ],
+      &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+    },
+  ],
+  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+    { # Associates `members` with a `role`.
+      &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+        &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+        &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
+        &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+        &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+      },
+      &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+        &quot;A String&quot;,
+      ],
+      &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+    },
+  ],
+  &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+  &quot;version&quot;: 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>
+  <pre>Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may &quot;fail open&quot; without warning.
+
+Args:
+  resource: string, REQUIRED: The resource for which the policy detail is being requested. See the operation documentation for the appropriate value for this field. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Request message for `TestIamPermissions` method.
+  &quot;permissions&quot;: [ # The set of permissions to check for the `resource`. Permissions with wildcards (such as &#x27;*&#x27; or &#x27;storage.*&#x27;) are not allowed. For more information see [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).
+    &quot;A String&quot;,
+  ],
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Response message for `TestIamPermissions` method.
+  &quot;permissions&quot;: [ # A subset of `TestPermissionsRequest.permissions` that the caller is allowed.
+    &quot;A String&quot;,
+  ],
+}</pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/networkservices_v1.projects.locations.endpointPolicies.html b/docs/dyn/networkservices_v1.projects.locations.endpointPolicies.html
new file mode 100644
index 0000000..2b1cbcd
--- /dev/null
+++ b/docs/dyn/networkservices_v1.projects.locations.endpointPolicies.html
@@ -0,0 +1,560 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="networkservices_v1.html">Network Services API</a> . <a href="networkservices_v1.projects.html">projects</a> . <a href="networkservices_v1.projects.locations.html">locations</a> . <a href="networkservices_v1.projects.locations.endpointPolicies.html">endpointPolicies</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#create">create(parent, body=None, endpointPolicyId=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Creates a new EndpointPolicy in a given project and location.</p>
+<p class="toc_element">
+  <code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>
+<p class="firstline">Deletes a single EndpointPolicy.</p>
+<p class="toc_element">
+  <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets details of a single EndpointPolicy.</p>
+<p class="toc_element">
+  <code><a href="#getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.</p>
+<p class="toc_element">
+  <code><a href="#list">list(parent, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Lists EndpointPolicies in a given project and location.</p>
+<p class="toc_element">
+  <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
+<p class="firstline">Retrieves the next page of results.</p>
+<p class="toc_element">
+  <code><a href="#patch">patch(name, body=None, updateMask=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Updates the parameters of a single EndpointPolicy.</p>
+<p class="toc_element">
+  <code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.</p>
+<p class="toc_element">
+  <code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may "fail open" without warning.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="create">create(parent, body=None, endpointPolicyId=None, x__xgafv=None)</code>
+  <pre>Creates a new EndpointPolicy in a given project and location.
+
+Args:
+  parent: string, Required. The parent resource of the EndpointPolicy. Must be in the format `projects/*/locations/global`. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # EndpointPolicy is a resource that helps apply desired configuration on the endpoints that match specific criteria. For example, this resource can be used to apply &quot;authentication config&quot; an all endpoints that serve on port 8080.
+  &quot;authorizationPolicy&quot;: &quot;A String&quot;, # Optional. This field specifies the URL of AuthorizationPolicy resource that applies authorization policies to the inbound traffic at the matched endpoints. Refer to Authorization. If this field is not specified, authorization is disabled(no authz checks) for this endpoint. Applicable only when EndpointPolicyType is SIDECAR_PROXY.
+  &quot;clientTlsPolicy&quot;: &quot;A String&quot;, # Optional. A URL referring to a ClientTlsPolicy resource. ClientTlsPolicy can be set to specify the authentication for traffic from the proxy to the actual endpoints. More specifically, it is applied to the outgoing traffic from the proxy to the endpoint. This is typically used for sidecar model where the proxy identifies itself as endpoint to the control plane, with the connection between sidecar and endpoint requiring authentication. If this field is not set, authentication is disabled(open). Applicable only when EndpointPolicyType is SIDECAR_PROXY.
+  &quot;createTime&quot;: &quot;A String&quot;, # Output only. The timestamp when the resource was created.
+  &quot;description&quot;: &quot;A String&quot;, # Optional. A free-text description of the resource. Max length 1024 characters.
+  &quot;endpointMatcher&quot;: { # A definition of a matcher that selects endpoints to which the policies should be applied. # Required. A matcher that selects endpoints to which the policies should be applied.
+    &quot;metadataLabelMatcher&quot;: { # The matcher that is based on node metadata presented by xDS clients. # The matcher is based on node metadata presented by xDS clients.
+      &quot;metadataLabelMatchCriteria&quot;: &quot;A String&quot;, # Specifies how matching should be done. Supported values are: MATCH_ANY: At least one of the Labels specified in the matcher should match the metadata presented by xDS client. MATCH_ALL: The metadata presented by the xDS client should contain all of the labels specified here. The selection is determined based on the best match. For example, suppose there are three EndpointPolicy resources P1, P2 and P3 and if P1 has a the matcher as MATCH_ANY , P2 has MATCH_ALL , and P3 has MATCH_ALL . If a client with label connects, the config from P1 will be selected. If a client with label connects, the config from P2 will be selected. If a client with label connects, the config from P3 will be selected. If there is more than one best match, (for example, if a config P4 with selector exists and if a client with label connects), an error will be thrown.
+      &quot;metadataLabels&quot;: [ # The list of label value pairs that must match labels in the provided metadata based on filterMatchCriteria This list can have at most 64 entries. The list can be empty if the match criteria is MATCH_ANY, to specify a wildcard match (i.e this matches any client).
+        { # Defines a name-pair value for a single label.
+          &quot;labelName&quot;: &quot;A String&quot;, # Required. Label name presented as key in xDS Node Metadata.
+          &quot;labelValue&quot;: &quot;A String&quot;, # Required. Label value presented as value corresponding to the above key, in xDS Node Metadata.
+        },
+      ],
+    },
+  },
+  &quot;labels&quot;: { # Optional. Set of label tags associated with the EndpointPolicy resource.
+    &quot;a_key&quot;: &quot;A String&quot;,
+  },
+  &quot;name&quot;: &quot;A String&quot;, # Required. Name of the EndpointPolicy resource. It matches pattern `projects/{project}/locations/global/endpointPolicies/{endpoint_policy}`.
+  &quot;serverTlsPolicy&quot;: &quot;A String&quot;, # Optional. A URL referring to ServerTlsPolicy resource. ServerTlsPolicy is used to determine the authentication policy to be applied to terminate the inbound traffic at the identified backends. If this field is not set, authentication is disabled(open) for this endpoint.
+  &quot;trafficPortSelector&quot;: { # Specification of a port-based selector. # Optional. Port selector for the (matched) endpoints. If no port selector is provided, the matched config is applied to all ports.
+    &quot;ports&quot;: [ # Optional. A list of ports. Can be port numbers or port range (example, [80-90] specifies all ports from 80 to 90, including 80 and 90) or named ports or * to specify all ports. If the list is empty, all ports are selected.
+      &quot;A String&quot;,
+    ],
+  },
+  &quot;type&quot;: &quot;A String&quot;, # Required. The type of endpoint policy. This is primarily used to validate the configuration.
+  &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The timestamp when the resource was updated.
+}
+
+  endpointPolicyId: string, Required. Short name of the EndpointPolicy resource to be created. E.g. &quot;CustomECS&quot;.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # This resource represents a long-running operation that is the result of a network API call.
+  &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+  &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+    &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+      {
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    ],
+    &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+  },
+  &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+  &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="delete">delete(name, x__xgafv=None)</code>
+  <pre>Deletes a single EndpointPolicy.
+
+Args:
+  name: string, Required. A name of the EndpointPolicy to delete. Must be in the format `projects/*/locations/global/endpointPolicies/*`. (required)
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # This resource represents a long-running operation that is the result of a network API call.
+  &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+  &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+    &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+      {
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    ],
+    &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+  },
+  &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+  &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="get">get(name, x__xgafv=None)</code>
+  <pre>Gets details of a single EndpointPolicy.
+
+Args:
+  name: string, Required. A name of the EndpointPolicy to get. Must be in the format `projects/*/locations/global/endpointPolicies/*`. (required)
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # EndpointPolicy is a resource that helps apply desired configuration on the endpoints that match specific criteria. For example, this resource can be used to apply &quot;authentication config&quot; an all endpoints that serve on port 8080.
+  &quot;authorizationPolicy&quot;: &quot;A String&quot;, # Optional. This field specifies the URL of AuthorizationPolicy resource that applies authorization policies to the inbound traffic at the matched endpoints. Refer to Authorization. If this field is not specified, authorization is disabled(no authz checks) for this endpoint. Applicable only when EndpointPolicyType is SIDECAR_PROXY.
+  &quot;clientTlsPolicy&quot;: &quot;A String&quot;, # Optional. A URL referring to a ClientTlsPolicy resource. ClientTlsPolicy can be set to specify the authentication for traffic from the proxy to the actual endpoints. More specifically, it is applied to the outgoing traffic from the proxy to the endpoint. This is typically used for sidecar model where the proxy identifies itself as endpoint to the control plane, with the connection between sidecar and endpoint requiring authentication. If this field is not set, authentication is disabled(open). Applicable only when EndpointPolicyType is SIDECAR_PROXY.
+  &quot;createTime&quot;: &quot;A String&quot;, # Output only. The timestamp when the resource was created.
+  &quot;description&quot;: &quot;A String&quot;, # Optional. A free-text description of the resource. Max length 1024 characters.
+  &quot;endpointMatcher&quot;: { # A definition of a matcher that selects endpoints to which the policies should be applied. # Required. A matcher that selects endpoints to which the policies should be applied.
+    &quot;metadataLabelMatcher&quot;: { # The matcher that is based on node metadata presented by xDS clients. # The matcher is based on node metadata presented by xDS clients.
+      &quot;metadataLabelMatchCriteria&quot;: &quot;A String&quot;, # Specifies how matching should be done. Supported values are: MATCH_ANY: At least one of the Labels specified in the matcher should match the metadata presented by xDS client. MATCH_ALL: The metadata presented by the xDS client should contain all of the labels specified here. The selection is determined based on the best match. For example, suppose there are three EndpointPolicy resources P1, P2 and P3 and if P1 has a the matcher as MATCH_ANY , P2 has MATCH_ALL , and P3 has MATCH_ALL . If a client with label connects, the config from P1 will be selected. If a client with label connects, the config from P2 will be selected. If a client with label connects, the config from P3 will be selected. If there is more than one best match, (for example, if a config P4 with selector exists and if a client with label connects), an error will be thrown.
+      &quot;metadataLabels&quot;: [ # The list of label value pairs that must match labels in the provided metadata based on filterMatchCriteria This list can have at most 64 entries. The list can be empty if the match criteria is MATCH_ANY, to specify a wildcard match (i.e this matches any client).
+        { # Defines a name-pair value for a single label.
+          &quot;labelName&quot;: &quot;A String&quot;, # Required. Label name presented as key in xDS Node Metadata.
+          &quot;labelValue&quot;: &quot;A String&quot;, # Required. Label value presented as value corresponding to the above key, in xDS Node Metadata.
+        },
+      ],
+    },
+  },
+  &quot;labels&quot;: { # Optional. Set of label tags associated with the EndpointPolicy resource.
+    &quot;a_key&quot;: &quot;A String&quot;,
+  },
+  &quot;name&quot;: &quot;A String&quot;, # Required. Name of the EndpointPolicy resource. It matches pattern `projects/{project}/locations/global/endpointPolicies/{endpoint_policy}`.
+  &quot;serverTlsPolicy&quot;: &quot;A String&quot;, # Optional. A URL referring to ServerTlsPolicy resource. ServerTlsPolicy is used to determine the authentication policy to be applied to terminate the inbound traffic at the identified backends. If this field is not set, authentication is disabled(open) for this endpoint.
+  &quot;trafficPortSelector&quot;: { # Specification of a port-based selector. # Optional. Port selector for the (matched) endpoints. If no port selector is provided, the matched config is applied to all ports.
+    &quot;ports&quot;: [ # Optional. A list of ports. Can be port numbers or port range (example, [80-90] specifies all ports from 80 to 90, including 80 and 90) or named ports or * to specify all ports. If the list is empty, all ports are selected.
+      &quot;A String&quot;,
+    ],
+  },
+  &quot;type&quot;: &quot;A String&quot;, # Required. The type of endpoint policy. This is primarily used to validate the configuration.
+  &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The timestamp when the resource was updated.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</code>
+  <pre>Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.
+
+Args:
+  resource: string, REQUIRED: The resource for which the policy is being requested. See the operation documentation for the appropriate value for this field. (required)
+  options_requestedPolicyVersion: integer, Optional. The policy format version to be returned. Valid values are 0, 1, and 3. Requests specifying an invalid value will be rejected. Requests for policies with any conditional bindings must specify version 3. Policies without any conditional bindings may specify any valid value or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+  &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
+    { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
+      &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
+        { # Provides the configuration for logging a type of permissions. Example: { &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; } ] } This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting jose@example.com from DATA_READ logging.
+          &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+            &quot;A String&quot;,
+          ],
+          &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
+        },
+      ],
+      &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+    },
+  ],
+  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+    { # Associates `members` with a `role`.
+      &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+        &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+        &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
+        &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+        &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+      },
+      &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+        &quot;A String&quot;,
+      ],
+      &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+    },
+  ],
+  &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+  &quot;version&quot;: 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list">list(parent, pageSize=None, pageToken=None, x__xgafv=None)</code>
+  <pre>Lists EndpointPolicies in a given project and location.
+
+Args:
+  parent: string, Required. The project and location from which the EndpointPolicies should be listed, specified in the format `projects/*/locations/global`. (required)
+  pageSize: integer, Maximum number of EndpointPolicies to return per call.
+  pageToken: string, The value returned by the last `ListEndpointPoliciesResponse` Indicates that this is a continuation of a prior `ListEndpointPolicies` call, and that the system should return the next page of data.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Response returned by the ListEndpointPolicies method.
+  &quot;endpointPolicies&quot;: [ # List of EndpointPolicy resources.
+    { # EndpointPolicy is a resource that helps apply desired configuration on the endpoints that match specific criteria. For example, this resource can be used to apply &quot;authentication config&quot; an all endpoints that serve on port 8080.
+      &quot;authorizationPolicy&quot;: &quot;A String&quot;, # Optional. This field specifies the URL of AuthorizationPolicy resource that applies authorization policies to the inbound traffic at the matched endpoints. Refer to Authorization. If this field is not specified, authorization is disabled(no authz checks) for this endpoint. Applicable only when EndpointPolicyType is SIDECAR_PROXY.
+      &quot;clientTlsPolicy&quot;: &quot;A String&quot;, # Optional. A URL referring to a ClientTlsPolicy resource. ClientTlsPolicy can be set to specify the authentication for traffic from the proxy to the actual endpoints. More specifically, it is applied to the outgoing traffic from the proxy to the endpoint. This is typically used for sidecar model where the proxy identifies itself as endpoint to the control plane, with the connection between sidecar and endpoint requiring authentication. If this field is not set, authentication is disabled(open). Applicable only when EndpointPolicyType is SIDECAR_PROXY.
+      &quot;createTime&quot;: &quot;A String&quot;, # Output only. The timestamp when the resource was created.
+      &quot;description&quot;: &quot;A String&quot;, # Optional. A free-text description of the resource. Max length 1024 characters.
+      &quot;endpointMatcher&quot;: { # A definition of a matcher that selects endpoints to which the policies should be applied. # Required. A matcher that selects endpoints to which the policies should be applied.
+        &quot;metadataLabelMatcher&quot;: { # The matcher that is based on node metadata presented by xDS clients. # The matcher is based on node metadata presented by xDS clients.
+          &quot;metadataLabelMatchCriteria&quot;: &quot;A String&quot;, # Specifies how matching should be done. Supported values are: MATCH_ANY: At least one of the Labels specified in the matcher should match the metadata presented by xDS client. MATCH_ALL: The metadata presented by the xDS client should contain all of the labels specified here. The selection is determined based on the best match. For example, suppose there are three EndpointPolicy resources P1, P2 and P3 and if P1 has a the matcher as MATCH_ANY , P2 has MATCH_ALL , and P3 has MATCH_ALL . If a client with label connects, the config from P1 will be selected. If a client with label connects, the config from P2 will be selected. If a client with label connects, the config from P3 will be selected. If there is more than one best match, (for example, if a config P4 with selector exists and if a client with label connects), an error will be thrown.
+          &quot;metadataLabels&quot;: [ # The list of label value pairs that must match labels in the provided metadata based on filterMatchCriteria This list can have at most 64 entries. The list can be empty if the match criteria is MATCH_ANY, to specify a wildcard match (i.e this matches any client).
+            { # Defines a name-pair value for a single label.
+              &quot;labelName&quot;: &quot;A String&quot;, # Required. Label name presented as key in xDS Node Metadata.
+              &quot;labelValue&quot;: &quot;A String&quot;, # Required. Label value presented as value corresponding to the above key, in xDS Node Metadata.
+            },
+          ],
+        },
+      },
+      &quot;labels&quot;: { # Optional. Set of label tags associated with the EndpointPolicy resource.
+        &quot;a_key&quot;: &quot;A String&quot;,
+      },
+      &quot;name&quot;: &quot;A String&quot;, # Required. Name of the EndpointPolicy resource. It matches pattern `projects/{project}/locations/global/endpointPolicies/{endpoint_policy}`.
+      &quot;serverTlsPolicy&quot;: &quot;A String&quot;, # Optional. A URL referring to ServerTlsPolicy resource. ServerTlsPolicy is used to determine the authentication policy to be applied to terminate the inbound traffic at the identified backends. If this field is not set, authentication is disabled(open) for this endpoint.
+      &quot;trafficPortSelector&quot;: { # Specification of a port-based selector. # Optional. Port selector for the (matched) endpoints. If no port selector is provided, the matched config is applied to all ports.
+        &quot;ports&quot;: [ # Optional. A list of ports. Can be port numbers or port range (example, [80-90] specifies all ports from 80 to 90, including 80 and 90) or named ports or * to specify all ports. If the list is empty, all ports are selected.
+          &quot;A String&quot;,
+        ],
+      },
+      &quot;type&quot;: &quot;A String&quot;, # Required. The type of endpoint policy. This is primarily used to validate the configuration.
+      &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The timestamp when the resource was updated.
+    },
+  ],
+  &quot;nextPageToken&quot;: &quot;A String&quot;, # If there might be more results than those appearing in this response, then `next_page_token` is included. To get the next set of results, call this method again using the value of `next_page_token` as `page_token`.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list_next">list_next(previous_request, previous_response)</code>
+  <pre>Retrieves the next page of results.
+
+Args:
+  previous_request: The request for the previous page. (required)
+  previous_response: The response from the request for the previous page. (required)
+
+Returns:
+  A request object that you can call &#x27;execute()&#x27; on to request the next
+  page. Returns None if there are no more items in the collection.
+    </pre>
+</div>
+
+<div class="method">
+    <code class="details" id="patch">patch(name, body=None, updateMask=None, x__xgafv=None)</code>
+  <pre>Updates the parameters of a single EndpointPolicy.
+
+Args:
+  name: string, Required. Name of the EndpointPolicy resource. It matches pattern `projects/{project}/locations/global/endpointPolicies/{endpoint_policy}`. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # EndpointPolicy is a resource that helps apply desired configuration on the endpoints that match specific criteria. For example, this resource can be used to apply &quot;authentication config&quot; an all endpoints that serve on port 8080.
+  &quot;authorizationPolicy&quot;: &quot;A String&quot;, # Optional. This field specifies the URL of AuthorizationPolicy resource that applies authorization policies to the inbound traffic at the matched endpoints. Refer to Authorization. If this field is not specified, authorization is disabled(no authz checks) for this endpoint. Applicable only when EndpointPolicyType is SIDECAR_PROXY.
+  &quot;clientTlsPolicy&quot;: &quot;A String&quot;, # Optional. A URL referring to a ClientTlsPolicy resource. ClientTlsPolicy can be set to specify the authentication for traffic from the proxy to the actual endpoints. More specifically, it is applied to the outgoing traffic from the proxy to the endpoint. This is typically used for sidecar model where the proxy identifies itself as endpoint to the control plane, with the connection between sidecar and endpoint requiring authentication. If this field is not set, authentication is disabled(open). Applicable only when EndpointPolicyType is SIDECAR_PROXY.
+  &quot;createTime&quot;: &quot;A String&quot;, # Output only. The timestamp when the resource was created.
+  &quot;description&quot;: &quot;A String&quot;, # Optional. A free-text description of the resource. Max length 1024 characters.
+  &quot;endpointMatcher&quot;: { # A definition of a matcher that selects endpoints to which the policies should be applied. # Required. A matcher that selects endpoints to which the policies should be applied.
+    &quot;metadataLabelMatcher&quot;: { # The matcher that is based on node metadata presented by xDS clients. # The matcher is based on node metadata presented by xDS clients.
+      &quot;metadataLabelMatchCriteria&quot;: &quot;A String&quot;, # Specifies how matching should be done. Supported values are: MATCH_ANY: At least one of the Labels specified in the matcher should match the metadata presented by xDS client. MATCH_ALL: The metadata presented by the xDS client should contain all of the labels specified here. The selection is determined based on the best match. For example, suppose there are three EndpointPolicy resources P1, P2 and P3 and if P1 has a the matcher as MATCH_ANY , P2 has MATCH_ALL , and P3 has MATCH_ALL . If a client with label connects, the config from P1 will be selected. If a client with label connects, the config from P2 will be selected. If a client with label connects, the config from P3 will be selected. If there is more than one best match, (for example, if a config P4 with selector exists and if a client with label connects), an error will be thrown.
+      &quot;metadataLabels&quot;: [ # The list of label value pairs that must match labels in the provided metadata based on filterMatchCriteria This list can have at most 64 entries. The list can be empty if the match criteria is MATCH_ANY, to specify a wildcard match (i.e this matches any client).
+        { # Defines a name-pair value for a single label.
+          &quot;labelName&quot;: &quot;A String&quot;, # Required. Label name presented as key in xDS Node Metadata.
+          &quot;labelValue&quot;: &quot;A String&quot;, # Required. Label value presented as value corresponding to the above key, in xDS Node Metadata.
+        },
+      ],
+    },
+  },
+  &quot;labels&quot;: { # Optional. Set of label tags associated with the EndpointPolicy resource.
+    &quot;a_key&quot;: &quot;A String&quot;,
+  },
+  &quot;name&quot;: &quot;A String&quot;, # Required. Name of the EndpointPolicy resource. It matches pattern `projects/{project}/locations/global/endpointPolicies/{endpoint_policy}`.
+  &quot;serverTlsPolicy&quot;: &quot;A String&quot;, # Optional. A URL referring to ServerTlsPolicy resource. ServerTlsPolicy is used to determine the authentication policy to be applied to terminate the inbound traffic at the identified backends. If this field is not set, authentication is disabled(open) for this endpoint.
+  &quot;trafficPortSelector&quot;: { # Specification of a port-based selector. # Optional. Port selector for the (matched) endpoints. If no port selector is provided, the matched config is applied to all ports.
+    &quot;ports&quot;: [ # Optional. A list of ports. Can be port numbers or port range (example, [80-90] specifies all ports from 80 to 90, including 80 and 90) or named ports or * to specify all ports. If the list is empty, all ports are selected.
+      &quot;A String&quot;,
+    ],
+  },
+  &quot;type&quot;: &quot;A String&quot;, # Required. The type of endpoint policy. This is primarily used to validate the configuration.
+  &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The timestamp when the resource was updated.
+}
+
+  updateMask: string, Optional. Field mask is used to specify the fields to be overwritten in the EndpointPolicy resource by the update. The fields specified in the update_mask are relative to the resource, not the full request. A field will be overwritten if it is in the mask. If the user does not provide a mask then all fields will be overwritten.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # This resource represents a long-running operation that is the result of a network API call.
+  &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+  &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+    &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+      {
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    ],
+    &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+  },
+  &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+  &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>
+  <pre>Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.
+
+Args:
+  resource: string, REQUIRED: The resource for which the policy is being specified. See the operation documentation for the appropriate value for this field. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Request message for `SetIamPolicy` method.
+  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+    &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
+      { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
+        &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
+          { # Provides the configuration for logging a type of permissions. Example: { &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; } ] } This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting jose@example.com from DATA_READ logging.
+            &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+              &quot;A String&quot;,
+            ],
+            &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
+          },
+        ],
+        &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+      },
+    ],
+    &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+      { # Associates `members` with a `role`.
+        &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+          &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+          &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
+          &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+          &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+        },
+        &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+          &quot;A String&quot;,
+        ],
+        &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+      },
+    ],
+    &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+    &quot;version&quot;: 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+  },
+  &quot;updateMask&quot;: &quot;A String&quot;, # OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only the fields in the mask will be modified. If no mask is provided, the following default mask is used: `paths: &quot;bindings, etag&quot;`
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+  &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
+    { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
+      &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
+        { # Provides the configuration for logging a type of permissions. Example: { &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; } ] } This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting jose@example.com from DATA_READ logging.
+          &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+            &quot;A String&quot;,
+          ],
+          &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
+        },
+      ],
+      &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+    },
+  ],
+  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+    { # Associates `members` with a `role`.
+      &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+        &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+        &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
+        &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+        &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+      },
+      &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+        &quot;A String&quot;,
+      ],
+      &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+    },
+  ],
+  &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+  &quot;version&quot;: 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>
+  <pre>Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may &quot;fail open&quot; without warning.
+
+Args:
+  resource: string, REQUIRED: The resource for which the policy detail is being requested. See the operation documentation for the appropriate value for this field. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # Request message for `TestIamPermissions` method.
+  &quot;permissions&quot;: [ # The set of permissions to check for the `resource`. Permissions with wildcards (such as &#x27;*&#x27; or &#x27;storage.*&#x27;) are not allowed. For more information see [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).
+    &quot;A String&quot;,
+  ],
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # Response message for `TestIamPermissions` method.
+  &quot;permissions&quot;: [ # A subset of `TestPermissionsRequest.permissions` that the caller is allowed.
+    &quot;A String&quot;,
+  ],
+}</pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/networkservices_v1.projects.locations.html b/docs/dyn/networkservices_v1.projects.locations.html
index 669495e..3bad56c 100644
--- a/docs/dyn/networkservices_v1.projects.locations.html
+++ b/docs/dyn/networkservices_v1.projects.locations.html
@@ -90,6 +90,11 @@
 <p class="firstline">Returns the edgeCacheServices Resource.</p>
 
 <p class="toc_element">
+  <code><a href="networkservices_v1.projects.locations.endpointPolicies.html">endpointPolicies()</a></code>
+</p>
+<p class="firstline">Returns the endpointPolicies Resource.</p>
+
+<p class="toc_element">
   <code><a href="networkservices_v1.projects.locations.operations.html">operations()</a></code>
 </p>
 <p class="firstline">Returns the operations Resource.</p>
diff --git a/docs/dyn/osconfig_v1.projects.locations.instances.html b/docs/dyn/osconfig_v1.projects.locations.instances.html
index ec1b103..2cb704a 100644
--- a/docs/dyn/osconfig_v1.projects.locations.instances.html
+++ b/docs/dyn/osconfig_v1.projects.locations.instances.html
@@ -80,6 +80,11 @@
 <p class="firstline">Returns the inventories Resource.</p>
 
 <p class="toc_element">
+  <code><a href="osconfig_v1.projects.locations.instances.osPolicyAssignments.html">osPolicyAssignments()</a></code>
+</p>
+<p class="firstline">Returns the osPolicyAssignments Resource.</p>
+
+<p class="toc_element">
   <code><a href="osconfig_v1.projects.locations.instances.vulnerabilityReports.html">vulnerabilityReports()</a></code>
 </p>
 <p class="firstline">Returns the vulnerabilityReports Resource.</p>
diff --git a/docs/dyn/osconfig_v1.projects.locations.instances.inventories.html b/docs/dyn/osconfig_v1.projects.locations.instances.inventories.html
index 8fb343d..af4f863 100644
--- a/docs/dyn/osconfig_v1.projects.locations.instances.inventories.html
+++ b/docs/dyn/osconfig_v1.projects.locations.instances.inventories.html
@@ -136,7 +136,7 @@
           &quot;hotFixId&quot;: &quot;A String&quot;, # Unique identifier associated with a particular QFE update.
           &quot;installTime&quot;: &quot;A String&quot;, # Date that the QFE update was installed. Mapped from installed_on field.
         },
-        &quot;windowsApplication&quot;: { # Contains information about a Windows application as retrieved from the Windows Registry. For more information about these fields, see [Windows Installer Properties for the Uninstall Registry](https://docs.microsoft.com/en-us/windows/win32/msi/uninstall-registry-key){: class=&quot;external&quot; } # Details of Windows Application.
+        &quot;windowsApplication&quot;: { # Contains information about a Windows application that is retrieved from the Windows Registry. For more information about these fields, see Windows Installer Properties for the Uninstall Registry. # Details of Windows Application.
           &quot;displayName&quot;: &quot;A String&quot;, # The name of the application or product.
           &quot;displayVersion&quot;: &quot;A String&quot;, # The version of the product or application in string format.
           &quot;helpLink&quot;: &quot;A String&quot;, # The internet address for technical support.
@@ -208,7 +208,7 @@
           &quot;hotFixId&quot;: &quot;A String&quot;, # Unique identifier associated with a particular QFE update.
           &quot;installTime&quot;: &quot;A String&quot;, # Date that the QFE update was installed. Mapped from installed_on field.
         },
-        &quot;windowsApplication&quot;: { # Contains information about a Windows application as retrieved from the Windows Registry. For more information about these fields, see [Windows Installer Properties for the Uninstall Registry](https://docs.microsoft.com/en-us/windows/win32/msi/uninstall-registry-key){: class=&quot;external&quot; } # Details of Windows Application.
+        &quot;windowsApplication&quot;: { # Contains information about a Windows application that is retrieved from the Windows Registry. For more information about these fields, see Windows Installer Properties for the Uninstall Registry. # Details of Windows Application.
           &quot;displayName&quot;: &quot;A String&quot;, # The name of the application or product.
           &quot;displayVersion&quot;: &quot;A String&quot;, # The version of the product or application in string format.
           &quot;helpLink&quot;: &quot;A String&quot;, # The internet address for technical support.
@@ -325,7 +325,7 @@
               &quot;hotFixId&quot;: &quot;A String&quot;, # Unique identifier associated with a particular QFE update.
               &quot;installTime&quot;: &quot;A String&quot;, # Date that the QFE update was installed. Mapped from installed_on field.
             },
-            &quot;windowsApplication&quot;: { # Contains information about a Windows application as retrieved from the Windows Registry. For more information about these fields, see [Windows Installer Properties for the Uninstall Registry](https://docs.microsoft.com/en-us/windows/win32/msi/uninstall-registry-key){: class=&quot;external&quot; } # Details of Windows Application.
+            &quot;windowsApplication&quot;: { # Contains information about a Windows application that is retrieved from the Windows Registry. For more information about these fields, see Windows Installer Properties for the Uninstall Registry. # Details of Windows Application.
               &quot;displayName&quot;: &quot;A String&quot;, # The name of the application or product.
               &quot;displayVersion&quot;: &quot;A String&quot;, # The version of the product or application in string format.
               &quot;helpLink&quot;: &quot;A String&quot;, # The internet address for technical support.
@@ -397,7 +397,7 @@
               &quot;hotFixId&quot;: &quot;A String&quot;, # Unique identifier associated with a particular QFE update.
               &quot;installTime&quot;: &quot;A String&quot;, # Date that the QFE update was installed. Mapped from installed_on field.
             },
-            &quot;windowsApplication&quot;: { # Contains information about a Windows application as retrieved from the Windows Registry. For more information about these fields, see [Windows Installer Properties for the Uninstall Registry](https://docs.microsoft.com/en-us/windows/win32/msi/uninstall-registry-key){: class=&quot;external&quot; } # Details of Windows Application.
+            &quot;windowsApplication&quot;: { # Contains information about a Windows application that is retrieved from the Windows Registry. For more information about these fields, see Windows Installer Properties for the Uninstall Registry. # Details of Windows Application.
               &quot;displayName&quot;: &quot;A String&quot;, # The name of the application or product.
               &quot;displayVersion&quot;: &quot;A String&quot;, # The version of the product or application in string format.
               &quot;helpLink&quot;: &quot;A String&quot;, # The internet address for technical support.
diff --git a/docs/dyn/osconfig_v1.projects.locations.instances.osPolicyAssignments.html b/docs/dyn/osconfig_v1.projects.locations.instances.osPolicyAssignments.html
new file mode 100644
index 0000000..63a93be
--- /dev/null
+++ b/docs/dyn/osconfig_v1.projects.locations.instances.osPolicyAssignments.html
@@ -0,0 +1,140 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="osconfig_v1.html">OS Config API</a> . <a href="osconfig_v1.projects.html">projects</a> . <a href="osconfig_v1.projects.locations.html">locations</a> . <a href="osconfig_v1.projects.locations.instances.html">instances</a> . <a href="osconfig_v1.projects.locations.instances.osPolicyAssignments.html">osPolicyAssignments</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="osconfig_v1.projects.locations.instances.osPolicyAssignments.reports.html">reports()</a></code>
+</p>
+<p class="firstline">Returns the reports Resource.</p>
+
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#getReport">getReport(name, x__xgafv=None)</a></code></p>
+<p class="firstline">Get the OS policy asssignment report for the specified Compute Engine VM instance.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="getReport">getReport(name, x__xgafv=None)</code>
+  <pre>Get the OS policy asssignment report for the specified Compute Engine VM instance.
+
+Args:
+  name: string, Required. API resource name for OS policy assignment report. Format: `/projects/{project}/locations/{location}/instances/{instance}/osPolicyAssignments/{assignment}/report` For `{project}`, either `project-number` or `project-id` can be provided. For `{instance_id}`, either Compute Engine `instance-id` or `instance-name` can be provided. For `{assignment_id}`, the OSPolicyAssignment id must be provided. (required)
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # A report of the OS policy assignment status for a given instance.
+  &quot;instance&quot;: &quot;A String&quot;, # The Compute Engine VM instance name.
+  &quot;lastRunId&quot;: &quot;A String&quot;, # Unique identifier of the last attempted run to apply the OS policies associated with this assignment on the VM. This ID is logged by the OS Config agent while applying the OS policies associated with this assignment on the VM. NOTE: If the service is unable to successfully connect to the agent for this run, then this id will not be available in the agent logs.
+  &quot;name&quot;: &quot;A String&quot;, # The `OSPolicyAssignmentReport` API resource name. Format: `projects/{project_number}/locations/{location}/instances/{instance_id}/osPolicyAssignments/{os_policy_assignment_id}/report`
+  &quot;osPolicyAssignment&quot;: &quot;A String&quot;, # Reference to the `OSPolicyAssignment` API resource that the `OSPolicy` belongs to. Format: `projects/{project_number}/locations/{location}/osPolicyAssignments/{os_policy_assignment_id@revision_id}`
+  &quot;osPolicyCompliances&quot;: [ # Compliance data for each `OSPolicy` that is applied to the VM.
+    { # Compliance data for an OS policy
+      &quot;complianceState&quot;: &quot;A String&quot;, # The compliance state of the OS policy.
+      &quot;complianceStateReason&quot;: &quot;A String&quot;, # The reason for the OS policy to be in an unknown compliance state. This field is always populated when `compliance_state` is `UNKNOWN`. If populated, the field can contain one of the following values: * `vm-not-running`: The VM was not running. * `os-policies-not-supported-by-agent`: The version of the OS Config agent running on the VM does not support running OS policies. * `no-agent-detected`: The OS Config agent is not detected for the VM. * `resource-execution-errors`: The OS Config agent encountered errors while executing one or more resources in the policy. See `os_policy_resource_compliances` for details. * `task-timeout`: The task sent to the agent to apply the policy timed out. * `unexpected-agent-state`: The OS Config agent did not report the final status of the task that attempted to apply the policy. Instead, the agent unexpectedly started working on a different task. This mostly happens when the agent or VM unexpectedly restarts while applying OS policies. * `internal-service-errors`: Internal service errors were encountered while attempting to apply the policy.
+      &quot;osPolicyId&quot;: &quot;A String&quot;, # The OS policy id
+      &quot;osPolicyResourceCompliances&quot;: [ # Compliance data for each resource within the policy that is applied to the VM.
+        { # Compliance data for an OS policy resource.
+          &quot;complianceState&quot;: &quot;A String&quot;, # The compliance state of the resource.
+          &quot;complianceStateReason&quot;: &quot;A String&quot;, # A reason for the resource to be in the given compliance state. This field is always populated when `compliance_state` is `UNKNOWN`. The following values are supported when `compliance_state == UNKNOWN` * `execution-errors`: Errors were encountered by the agent while executing the resource and the compliance state couldn&#x27;t be determined. * `execution-skipped-by-agent`: Resource execution was skipped by the agent because errors were encountered while executing prior resources in the OS policy. * `os-policy-execution-attempt-failed`: The execution of the OS policy containing this resource failed and the compliance state couldn&#x27;t be determined.
+          &quot;configSteps&quot;: [ # Ordered list of configuration completed by the agent for the OS policy resource.
+            { # Step performed by the OS Config agent for configuring an `OSPolicy` resource to its desired state.
+              &quot;errorMessage&quot;: &quot;A String&quot;, # An error message recorded during the execution of this step. Only populated if errors were encountered during this step execution.
+              &quot;type&quot;: &quot;A String&quot;, # Configuration step type.
+            },
+          ],
+          &quot;execResourceOutput&quot;: { # ExecResource specific output. # ExecResource specific output.
+            &quot;enforcementOutput&quot;: &quot;A String&quot;, # Output from enforcement phase output file (if run). Output size is limited to 100K bytes.
+          },
+          &quot;osPolicyResourceId&quot;: &quot;A String&quot;, # The ID of the OS policy resource.
+        },
+      ],
+    },
+  ],
+  &quot;updateTime&quot;: &quot;A String&quot;, # Timestamp for when the report was last generated.
+}</pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/osconfig_v1.projects.locations.instances.osPolicyAssignments.reports.html b/docs/dyn/osconfig_v1.projects.locations.instances.osPolicyAssignments.reports.html
new file mode 100644
index 0000000..c47c131
--- /dev/null
+++ b/docs/dyn/osconfig_v1.projects.locations.instances.osPolicyAssignments.reports.html
@@ -0,0 +1,160 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="osconfig_v1.html">OS Config API</a> . <a href="osconfig_v1.projects.html">projects</a> . <a href="osconfig_v1.projects.locations.html">locations</a> . <a href="osconfig_v1.projects.locations.instances.html">instances</a> . <a href="osconfig_v1.projects.locations.instances.osPolicyAssignments.html">osPolicyAssignments</a> . <a href="osconfig_v1.projects.locations.instances.osPolicyAssignments.reports.html">reports</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#list">list(parent, filter=None, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>
+<p class="firstline">List OS policy asssignment reports for all Compute Engine VM instances in the specified zone.</p>
+<p class="toc_element">
+  <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
+<p class="firstline">Retrieves the next page of results.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list">list(parent, filter=None, pageSize=None, pageToken=None, x__xgafv=None)</code>
+  <pre>List OS policy asssignment reports for all Compute Engine VM instances in the specified zone.
+
+Args:
+  parent: string, Required. The parent resource name. Format: `projects/{project}/locations/{location}/instances/{instance}/osPolicyAssignments/{assignment}/reports` For `{project}`, either `project-number` or `project-id` can be provided. For `{instance}`, either `instance-name`, `instance-id`, or `-` can be provided. If &#x27;-&#x27; is provided, the response will include OSPolicyAssignmentReports for all instances in the project/location. For `{assignment}`, either `assignment-id` or `-` can be provided. If &#x27;-&#x27; is provided, the response will include OSPolicyAssignmentReports for all OSPolicyAssignments in the project/location. Either {instance} or {assignment} must be `-`. For example: `projects/{project}/locations/{location}/instances/{instance}/osPolicyAssignments/-/reports` returns all reports for the instance `projects/{project}/locations/{location}/instances/-/osPolicyAssignments/{assignment-id}/reports` returns all the reports for the given assignment across all instances. `projects/{project}/locations/{location}/instances/-/osPolicyAssignments/-/reports` returns all the reports for all assignments across all instances. (required)
+  filter: string, If provided, this field specifies the criteria that must be met by the `OSPolicyAssignmentReport` API resource that is included in the response.
+  pageSize: integer, The maximum number of results to return.
+  pageToken: string, A pagination token returned from a previous call to the `ListOSPolicyAssignmentReports` method that indicates where this listing should continue from.
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # A response message for listing OS Policy assignment reports including the page of results and page token.
+  &quot;nextPageToken&quot;: &quot;A String&quot;, # The pagination token to retrieve the next page of OS policy assignment report objects.
+  &quot;osPolicyAssignmentReports&quot;: [ # List of OS policy assignment reports.
+    { # A report of the OS policy assignment status for a given instance.
+      &quot;instance&quot;: &quot;A String&quot;, # The Compute Engine VM instance name.
+      &quot;lastRunId&quot;: &quot;A String&quot;, # Unique identifier of the last attempted run to apply the OS policies associated with this assignment on the VM. This ID is logged by the OS Config agent while applying the OS policies associated with this assignment on the VM. NOTE: If the service is unable to successfully connect to the agent for this run, then this id will not be available in the agent logs.
+      &quot;name&quot;: &quot;A String&quot;, # The `OSPolicyAssignmentReport` API resource name. Format: `projects/{project_number}/locations/{location}/instances/{instance_id}/osPolicyAssignments/{os_policy_assignment_id}/report`
+      &quot;osPolicyAssignment&quot;: &quot;A String&quot;, # Reference to the `OSPolicyAssignment` API resource that the `OSPolicy` belongs to. Format: `projects/{project_number}/locations/{location}/osPolicyAssignments/{os_policy_assignment_id@revision_id}`
+      &quot;osPolicyCompliances&quot;: [ # Compliance data for each `OSPolicy` that is applied to the VM.
+        { # Compliance data for an OS policy
+          &quot;complianceState&quot;: &quot;A String&quot;, # The compliance state of the OS policy.
+          &quot;complianceStateReason&quot;: &quot;A String&quot;, # The reason for the OS policy to be in an unknown compliance state. This field is always populated when `compliance_state` is `UNKNOWN`. If populated, the field can contain one of the following values: * `vm-not-running`: The VM was not running. * `os-policies-not-supported-by-agent`: The version of the OS Config agent running on the VM does not support running OS policies. * `no-agent-detected`: The OS Config agent is not detected for the VM. * `resource-execution-errors`: The OS Config agent encountered errors while executing one or more resources in the policy. See `os_policy_resource_compliances` for details. * `task-timeout`: The task sent to the agent to apply the policy timed out. * `unexpected-agent-state`: The OS Config agent did not report the final status of the task that attempted to apply the policy. Instead, the agent unexpectedly started working on a different task. This mostly happens when the agent or VM unexpectedly restarts while applying OS policies. * `internal-service-errors`: Internal service errors were encountered while attempting to apply the policy.
+          &quot;osPolicyId&quot;: &quot;A String&quot;, # The OS policy id
+          &quot;osPolicyResourceCompliances&quot;: [ # Compliance data for each resource within the policy that is applied to the VM.
+            { # Compliance data for an OS policy resource.
+              &quot;complianceState&quot;: &quot;A String&quot;, # The compliance state of the resource.
+              &quot;complianceStateReason&quot;: &quot;A String&quot;, # A reason for the resource to be in the given compliance state. This field is always populated when `compliance_state` is `UNKNOWN`. The following values are supported when `compliance_state == UNKNOWN` * `execution-errors`: Errors were encountered by the agent while executing the resource and the compliance state couldn&#x27;t be determined. * `execution-skipped-by-agent`: Resource execution was skipped by the agent because errors were encountered while executing prior resources in the OS policy. * `os-policy-execution-attempt-failed`: The execution of the OS policy containing this resource failed and the compliance state couldn&#x27;t be determined.
+              &quot;configSteps&quot;: [ # Ordered list of configuration completed by the agent for the OS policy resource.
+                { # Step performed by the OS Config agent for configuring an `OSPolicy` resource to its desired state.
+                  &quot;errorMessage&quot;: &quot;A String&quot;, # An error message recorded during the execution of this step. Only populated if errors were encountered during this step execution.
+                  &quot;type&quot;: &quot;A String&quot;, # Configuration step type.
+                },
+              ],
+              &quot;execResourceOutput&quot;: { # ExecResource specific output. # ExecResource specific output.
+                &quot;enforcementOutput&quot;: &quot;A String&quot;, # Output from enforcement phase output file (if run). Output size is limited to 100K bytes.
+              },
+              &quot;osPolicyResourceId&quot;: &quot;A String&quot;, # The ID of the OS policy resource.
+            },
+          ],
+        },
+      ],
+      &quot;updateTime&quot;: &quot;A String&quot;, # Timestamp for when the report was last generated.
+    },
+  ],
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="list_next">list_next(previous_request, previous_response)</code>
+  <pre>Retrieves the next page of results.
+
+Args:
+  previous_request: The request for the previous page. (required)
+  previous_response: The response from the request for the previous page. (required)
+
+Returns:
+  A request object that you can call &#x27;execute()&#x27; on to request the next
+  page. Returns None if there are no more items in the collection.
+    </pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/osconfig_v1.projects.locations.osPolicyAssignments.html b/docs/dyn/osconfig_v1.projects.locations.osPolicyAssignments.html
index f4d99c2..73e0f38 100644
--- a/docs/dyn/osconfig_v1.projects.locations.osPolicyAssignments.html
+++ b/docs/dyn/osconfig_v1.projects.locations.osPolicyAssignments.html
@@ -75,6 +75,11 @@
 <h1><a href="osconfig_v1.html">OS Config API</a> . <a href="osconfig_v1.projects.html">projects</a> . <a href="osconfig_v1.projects.locations.html">locations</a> . <a href="osconfig_v1.projects.locations.osPolicyAssignments.html">osPolicyAssignments</a></h1>
 <h2>Instance Methods</h2>
 <p class="toc_element">
+  <code><a href="osconfig_v1.projects.locations.osPolicyAssignments.operations.html">operations()</a></code>
+</p>
+<p class="firstline">Returns the operations Resource.</p>
+
+<p class="toc_element">
   <code><a href="#close">close()</a></code></p>
 <p class="firstline">Close httplib2 connections.</p>
 <p class="toc_element">
diff --git a/docs/dyn/osconfig_v1.projects.locations.osPolicyAssignments.operations.html b/docs/dyn/osconfig_v1.projects.locations.osPolicyAssignments.operations.html
new file mode 100644
index 0000000..b926122
--- /dev/null
+++ b/docs/dyn/osconfig_v1.projects.locations.osPolicyAssignments.operations.html
@@ -0,0 +1,151 @@
+<html><body>
+<style>
+
+body, h1, h2, h3, div, span, p, pre, a {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  font-weight: inherit;
+  font-style: inherit;
+  font-size: 100%;
+  font-family: inherit;
+  vertical-align: baseline;
+}
+
+body {
+  font-size: 13px;
+  padding: 1em;
+}
+
+h1 {
+  font-size: 26px;
+  margin-bottom: 1em;
+}
+
+h2 {
+  font-size: 24px;
+  margin-bottom: 1em;
+}
+
+h3 {
+  font-size: 20px;
+  margin-bottom: 1em;
+  margin-top: 1em;
+}
+
+pre, code {
+  line-height: 1.5;
+  font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
+}
+
+pre {
+  margin-top: 0.5em;
+}
+
+h1, h2, h3, p {
+  font-family: Arial, sans serif;
+}
+
+h1, h2, h3 {
+  border-bottom: solid #CCC 1px;
+}
+
+.toc_element {
+  margin-top: 0.5em;
+}
+
+.firstline {
+  margin-left: 2 em;
+}
+
+.method  {
+  margin-top: 1em;
+  border: solid 1px #CCC;
+  padding: 1em;
+  background: #EEE;
+}
+
+.details {
+  font-weight: bold;
+  font-size: 14px;
+}
+
+</style>
+
+<h1><a href="osconfig_v1.html">OS Config API</a> . <a href="osconfig_v1.projects.html">projects</a> . <a href="osconfig_v1.projects.locations.html">locations</a> . <a href="osconfig_v1.projects.locations.osPolicyAssignments.html">osPolicyAssignments</a> . <a href="osconfig_v1.projects.locations.osPolicyAssignments.operations.html">operations</a></h1>
+<h2>Instance Methods</h2>
+<p class="toc_element">
+  <code><a href="#cancel">cancel(name, body=None, x__xgafv=None)</a></code></p>
+<p class="firstline">Starts asynchronous cancellation on a long-running operation. The server makes a best effort to cancel the operation, but success is not guaranteed. If the server doesn't support this method, it returns `google.rpc.Code.UNIMPLEMENTED`. Clients can use Operations.GetOperation or other methods to check whether the cancellation succeeded or whether the operation completed despite cancellation. On successful cancellation, the operation is not deleted; instead, it becomes an operation with an Operation.error value with a google.rpc.Status.code of 1, corresponding to `Code.CANCELLED`.</p>
+<p class="toc_element">
+  <code><a href="#close">close()</a></code></p>
+<p class="firstline">Close httplib2 connections.</p>
+<p class="toc_element">
+  <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
+<p class="firstline">Gets the latest state of a long-running operation. Clients can use this method to poll the operation result at intervals as recommended by the API service.</p>
+<h3>Method Details</h3>
+<div class="method">
+    <code class="details" id="cancel">cancel(name, body=None, x__xgafv=None)</code>
+  <pre>Starts asynchronous cancellation on a long-running operation. The server makes a best effort to cancel the operation, but success is not guaranteed. If the server doesn&#x27;t support this method, it returns `google.rpc.Code.UNIMPLEMENTED`. Clients can use Operations.GetOperation or other methods to check whether the cancellation succeeded or whether the operation completed despite cancellation. On successful cancellation, the operation is not deleted; instead, it becomes an operation with an Operation.error value with a google.rpc.Status.code of 1, corresponding to `Code.CANCELLED`.
+
+Args:
+  name: string, The name of the operation resource to be cancelled. (required)
+  body: object, The request body.
+    The object takes the form of:
+
+{ # The request message for Operations.CancelOperation.
+}
+
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); } The JSON representation for `Empty` is empty JSON object `{}`.
+}</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="close">close()</code>
+  <pre>Close httplib2 connections.</pre>
+</div>
+
+<div class="method">
+    <code class="details" id="get">get(name, x__xgafv=None)</code>
+  <pre>Gets the latest state of a long-running operation. Clients can use this method to poll the operation result at intervals as recommended by the API service.
+
+Args:
+  name: string, The name of the operation resource. (required)
+  x__xgafv: string, V1 error format.
+    Allowed values
+      1 - v1 error format
+      2 - v2 error format
+
+Returns:
+  An object of the form:
+
+    { # This resource represents a long-running operation that is the result of a network API call.
+  &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
+  &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
+    &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
+    &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+      {
+        &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+      },
+    ],
+    &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+  },
+  &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+  &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
+  &quot;response&quot;: { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
+    &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
+  },
+}</pre>
+</div>
+
+</body></html>
\ No newline at end of file
diff --git a/docs/dyn/osconfig_v1alpha.projects.locations.instances.inventories.html b/docs/dyn/osconfig_v1alpha.projects.locations.instances.inventories.html
index 51fec74..0766546 100644
--- a/docs/dyn/osconfig_v1alpha.projects.locations.instances.inventories.html
+++ b/docs/dyn/osconfig_v1alpha.projects.locations.instances.inventories.html
@@ -136,7 +136,7 @@
           &quot;hotFixId&quot;: &quot;A String&quot;, # Unique identifier associated with a particular QFE update.
           &quot;installTime&quot;: &quot;A String&quot;, # Date that the QFE update was installed. Mapped from installed_on field.
         },
-        &quot;windowsApplication&quot;: { # Contains information about a Windows application as retrieved from the Windows Registry. For more information about these fields, see [Windows Installer Properties for the Uninstall Registry](https://docs.microsoft.com/en-us/windows/win32/msi/uninstall-registry-key){: class=&quot;external&quot; } # Details of Windows Application.
+        &quot;windowsApplication&quot;: { # Contains information about a Windows application that is retrieved from the Windows Registry. For more information about these fields, see Windows Installer Properties for the Uninstall Registry. # Details of Windows Application.
           &quot;displayName&quot;: &quot;A String&quot;, # The name of the application or product.
           &quot;displayVersion&quot;: &quot;A String&quot;, # The version of the product or application in string format.
           &quot;helpLink&quot;: &quot;A String&quot;, # The internet address for technical support.
@@ -208,7 +208,7 @@
           &quot;hotFixId&quot;: &quot;A String&quot;, # Unique identifier associated with a particular QFE update.
           &quot;installTime&quot;: &quot;A String&quot;, # Date that the QFE update was installed. Mapped from installed_on field.
         },
-        &quot;windowsApplication&quot;: { # Contains information about a Windows application as retrieved from the Windows Registry. For more information about these fields, see [Windows Installer Properties for the Uninstall Registry](https://docs.microsoft.com/en-us/windows/win32/msi/uninstall-registry-key){: class=&quot;external&quot; } # Details of Windows Application.
+        &quot;windowsApplication&quot;: { # Contains information about a Windows application that is retrieved from the Windows Registry. For more information about these fields, see Windows Installer Properties for the Uninstall Registry. # Details of Windows Application.
           &quot;displayName&quot;: &quot;A String&quot;, # The name of the application or product.
           &quot;displayVersion&quot;: &quot;A String&quot;, # The version of the product or application in string format.
           &quot;helpLink&quot;: &quot;A String&quot;, # The internet address for technical support.
@@ -325,7 +325,7 @@
               &quot;hotFixId&quot;: &quot;A String&quot;, # Unique identifier associated with a particular QFE update.
               &quot;installTime&quot;: &quot;A String&quot;, # Date that the QFE update was installed. Mapped from installed_on field.
             },
-            &quot;windowsApplication&quot;: { # Contains information about a Windows application as retrieved from the Windows Registry. For more information about these fields, see [Windows Installer Properties for the Uninstall Registry](https://docs.microsoft.com/en-us/windows/win32/msi/uninstall-registry-key){: class=&quot;external&quot; } # Details of Windows Application.
+            &quot;windowsApplication&quot;: { # Contains information about a Windows application that is retrieved from the Windows Registry. For more information about these fields, see Windows Installer Properties for the Uninstall Registry. # Details of Windows Application.
               &quot;displayName&quot;: &quot;A String&quot;, # The name of the application or product.
               &quot;displayVersion&quot;: &quot;A String&quot;, # The version of the product or application in string format.
               &quot;helpLink&quot;: &quot;A String&quot;, # The internet address for technical support.
@@ -397,7 +397,7 @@
               &quot;hotFixId&quot;: &quot;A String&quot;, # Unique identifier associated with a particular QFE update.
               &quot;installTime&quot;: &quot;A String&quot;, # Date that the QFE update was installed. Mapped from installed_on field.
             },
-            &quot;windowsApplication&quot;: { # Contains information about a Windows application as retrieved from the Windows Registry. For more information about these fields, see [Windows Installer Properties for the Uninstall Registry](https://docs.microsoft.com/en-us/windows/win32/msi/uninstall-registry-key){: class=&quot;external&quot; } # Details of Windows Application.
+            &quot;windowsApplication&quot;: { # Contains information about a Windows application that is retrieved from the Windows Registry. For more information about these fields, see Windows Installer Properties for the Uninstall Registry. # Details of Windows Application.
               &quot;displayName&quot;: &quot;A String&quot;, # The name of the application or product.
               &quot;displayVersion&quot;: &quot;A String&quot;, # The version of the product or application in string format.
               &quot;helpLink&quot;: &quot;A String&quot;, # The internet address for technical support.
diff --git a/docs/dyn/paymentsresellersubscription_v1.partners.promotions.html b/docs/dyn/paymentsresellersubscription_v1.partners.promotions.html
index f963b55..79b23c7 100644
--- a/docs/dyn/paymentsresellersubscription_v1.partners.promotions.html
+++ b/docs/dyn/paymentsresellersubscription_v1.partners.promotions.html
@@ -114,7 +114,7 @@
         &quot;A String&quot;,
       ],
       &quot;endTime&quot;: &quot;A String&quot;, # Optional. Specifies the end time (exclusive) of the period that the promotion is available in. If unset, the promotion is available indefinitely.
-      &quot;freeTrialDuration&quot;: { # Describes the length of a period of a time. # Output only. Specifies the duration of the free trial of the subscription.
+      &quot;freeTrialDuration&quot;: { # Describes the length of a period of a time. # Optional. Specifies the duration of the free trial of the subscription when promotion_type is PROMOTION_TYPE_FREE_TRIAL
         &quot;count&quot;: 42, # number of duration units to be included.
         &quot;unit&quot;: &quot;A String&quot;, # The unit used for the duration
       },
diff --git a/docs/dyn/policytroubleshooter_v1.iam.html b/docs/dyn/policytroubleshooter_v1.iam.html
index a2ce42a..56a64c1 100644
--- a/docs/dyn/policytroubleshooter_v1.iam.html
+++ b/docs/dyn/policytroubleshooter_v1.iam.html
@@ -79,7 +79,7 @@
 <p class="firstline">Close httplib2 connections.</p>
 <p class="toc_element">
   <code><a href="#troubleshoot">troubleshoot(body=None, x__xgafv=None)</a></code></p>
-<p class="firstline">Checks whether a member has a specific permission for a specific resource, and explains why the member does or does not have that permission.</p>
+<p class="firstline">Checks whether a principal has a specific permission for a specific resource, and explains why the principal does or does not have that permission.</p>
 <h3>Method Details</h3>
 <div class="method">
     <code class="details" id="close">close()</code>
@@ -88,17 +88,17 @@
 
 <div class="method">
     <code class="details" id="troubleshoot">troubleshoot(body=None, x__xgafv=None)</code>
-  <pre>Checks whether a member has a specific permission for a specific resource, and explains why the member does or does not have that permission.
+  <pre>Checks whether a principal has a specific permission for a specific resource, and explains why the principal does or does not have that permission.
 
 Args:
   body: object, The request body.
     The object takes the form of:
 
 { # Request for TroubleshootIamPolicy.
-  &quot;accessTuple&quot;: { # Information about the member, resource, and permission to check. # The information to use for checking whether a member has a permission for a resource.
+  &quot;accessTuple&quot;: { # Information about the principal, resource, and permission to check. # The information to use for checking whether a principal has a permission for a resource.
     &quot;fullResourceName&quot;: &quot;A String&quot;, # Required. The full resource name that identifies the resource. For example, `//compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/my-instance`. For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names.
-    &quot;permission&quot;: &quot;A String&quot;, # Required. The IAM permission to check for the specified member and resource. For a complete list of IAM permissions, see https://cloud.google.com/iam/help/permissions/reference. For a complete list of predefined IAM roles and the permissions in each role, see https://cloud.google.com/iam/help/roles/reference.
-    &quot;principal&quot;: &quot;A String&quot;, # Required. The member, or principal, whose access you want to check, in the form of the email address that represents that member. For example, `alice@example.com` or `my-service-account@my-project.iam.gserviceaccount.com`. The member must be a Google Account or a service account. Other types of members are not supported.
+    &quot;permission&quot;: &quot;A String&quot;, # Required. The IAM permission to check for the specified principal and resource. For a complete list of IAM permissions, see https://cloud.google.com/iam/help/permissions/reference. For a complete list of predefined IAM roles and the permissions in each role, see https://cloud.google.com/iam/help/roles/reference.
+    &quot;principal&quot;: &quot;A String&quot;, # Required. The principal whose access you want to check, in the form of the email address that represents that principal. For example, `alice@example.com` or `my-service-account@my-project.iam.gserviceaccount.com`. The principal must be a Google Account or a service account. Other types of principals are not supported.
   },
 }
 
@@ -111,23 +111,23 @@
   An object of the form:
 
     { # Response for TroubleshootIamPolicy.
-  &quot;access&quot;: &quot;A String&quot;, # Indicates whether the member has the specified permission for the specified resource, based on evaluating all of the applicable IAM policies.
-  &quot;explainedPolicies&quot;: [ # List of IAM policies that were evaluated to check the member&#x27;s permissions, with annotations to indicate how each policy contributed to the final result. The list of policies can include the policy for the resource itself. It can also include policies that are inherited from higher levels of the resource hierarchy, including the organization, the folder, and the project. To learn more about the resource hierarchy, see https://cloud.google.com/iam/help/resource-hierarchy.
+  &quot;access&quot;: &quot;A String&quot;, # Indicates whether the principal has the specified permission for the specified resource, based on evaluating all of the applicable IAM policies.
+  &quot;explainedPolicies&quot;: [ # List of IAM policies that were evaluated to check the principal&#x27;s permissions, with annotations to indicate how each policy contributed to the final result. The list of policies can include the policy for the resource itself. It can also include policies that are inherited from higher levels of the resource hierarchy, including the organization, the folder, and the project. To learn more about the resource hierarchy, see https://cloud.google.com/iam/help/resource-hierarchy.
     { # Details about how a specific IAM Policy contributed to the access check.
-      &quot;access&quot;: &quot;A String&quot;, # Indicates whether _this policy_ provides the specified permission to the specified member for the specified resource. This field does _not_ indicate whether the member actually has the permission for the resource. There might be another policy that overrides this policy. To determine whether the member actually has the permission, use the `access` field in the TroubleshootIamPolicyResponse.
-      &quot;bindingExplanations&quot;: [ # Details about how each binding in the policy affects the member&#x27;s ability, or inability, to use the permission for the resource. If the sender of the request does not have access to the policy, this field is omitted.
-        { # Details about how a binding in a policy affects a member&#x27;s ability to use a permission.
-          &quot;access&quot;: &quot;A String&quot;, # Required. Indicates whether _this binding_ provides the specified permission to the specified member for the specified resource. This field does _not_ indicate whether the member actually has the permission for the resource. There might be another binding that overrides this binding. To determine whether the member actually has the permission, use the `access` field in the TroubleshootIamPolicyResponse.
-          &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # A condition expression that prevents access unless the expression evaluates to `true`. To learn about IAM Conditions, see http://cloud.google.com/iam/help/conditions/overview.
+      &quot;access&quot;: &quot;A String&quot;, # Indicates whether _this policy_ provides the specified permission to the specified principal for the specified resource. This field does _not_ indicate whether the principal actually has the permission for the resource. There might be another policy that overrides this policy. To determine whether the principal actually has the permission, use the `access` field in the TroubleshootIamPolicyResponse.
+      &quot;bindingExplanations&quot;: [ # Details about how each binding in the policy affects the principal&#x27;s ability, or inability, to use the permission for the resource. If the sender of the request does not have access to the policy, this field is omitted.
+        { # Details about how a binding in a policy affects a principal&#x27;s ability to use a permission.
+          &quot;access&quot;: &quot;A String&quot;, # Required. Indicates whether _this binding_ provides the specified permission to the specified principal for the specified resource. This field does _not_ indicate whether the principal actually has the permission for the resource. There might be another binding that overrides this binding. To determine whether the principal actually has the permission, use the `access` field in the TroubleshootIamPolicyResponse.
+          &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # A condition expression that prevents this binding from granting access unless the expression evaluates to `true`. To learn about IAM Conditions, see http://cloud.google.com/iam/help/conditions/overview.
             &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
             &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language syntax.
             &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
             &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
           },
-          &quot;memberships&quot;: { # Indicates whether each member in the binding includes the member specified in the request, either directly or indirectly. Each key identifies a member in the binding, and each value indicates whether the member in the binding includes the member in the request. For example, suppose that a binding includes the following members: * `user:alice@example.com` * `group:product-eng@example.com` You want to troubleshoot access for `user:bob@example.com`. This user is a member of the group `group:product-eng@example.com`. For the first member in the binding, the key is `user:alice@example.com`, and the `membership` field in the value is set to `MEMBERSHIP_NOT_INCLUDED`. For the second member in the binding, the key is `group:product-eng@example.com`, and the `membership` field in the value is set to `MEMBERSHIP_INCLUDED`.
-            &quot;a_key&quot;: { # Details about whether the binding includes the member.
-              &quot;membership&quot;: &quot;A String&quot;, # Indicates whether the binding includes the member.
-              &quot;relevance&quot;: &quot;A String&quot;, # The relevance of the member&#x27;s status to the overall determination for the binding.
+          &quot;memberships&quot;: { # Indicates whether each principal in the binding includes the principal specified in the request, either directly or indirectly. Each key identifies a principal in the binding, and each value indicates whether the principal in the binding includes the principal in the request. For example, suppose that a binding includes the following principals: * `user:alice@example.com` * `group:product-eng@example.com` You want to troubleshoot access for `user:bob@example.com`. This user is a principal of the group `group:product-eng@example.com`. For the first principal in the binding, the key is `user:alice@example.com`, and the `membership` field in the value is set to `MEMBERSHIP_NOT_INCLUDED`. For the second principal in the binding, the key is `group:product-eng@example.com`, and the `membership` field in the value is set to `MEMBERSHIP_INCLUDED`.
+            &quot;a_key&quot;: { # Details about whether the binding includes the principal.
+              &quot;membership&quot;: &quot;A String&quot;, # Indicates whether the binding includes the principal.
+              &quot;relevance&quot;: &quot;A String&quot;, # The relevance of the principal&#x27;s status to the overall determination for the binding.
             },
           },
           &quot;relevance&quot;: &quot;A String&quot;, # The relevance of this binding to the overall determination for the entire policy.
@@ -151,7 +151,7 @@
             &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
           },
         ],
-        &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+        &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member. The `bindings` in a `Policy` can refer to up to 1,500 members; up to 250 of these members can be Google groups. Each occurrence of a member counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other member, then you can add another 1,450 members to the `bindings` in the `Policy`.
           { # Associates `members` with a `role`.
             &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
               &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
diff --git a/docs/dyn/policytroubleshooter_v1beta.iam.html b/docs/dyn/policytroubleshooter_v1beta.iam.html
index fbb184a..4dda52d 100644
--- a/docs/dyn/policytroubleshooter_v1beta.iam.html
+++ b/docs/dyn/policytroubleshooter_v1beta.iam.html
@@ -151,7 +151,7 @@
             &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
           },
         ],
-        &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+        &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member. The `bindings` in a `Policy` can refer to up to 1,500 members; up to 250 of these members can be Google groups. Each occurrence of a member counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other member, then you can add another 1,450 members to the `bindings` in the `Policy`.
           { # Associates `members` with a `role`.
             &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
               &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
diff --git a/docs/dyn/privateca_v1.projects.locations.caPools.html b/docs/dyn/privateca_v1.projects.locations.caPools.html
index 62dcca1..d94ecc2 100644
--- a/docs/dyn/privateca_v1.projects.locations.caPools.html
+++ b/docs/dyn/privateca_v1.projects.locations.caPools.html
@@ -144,8 +144,8 @@
           &quot;signatureAlgorithm&quot;: &quot;A String&quot;, # Optional. A signature algorithm that must be used. If this is omitted, any EC-based signature algorithm will be allowed.
         },
         &quot;rsa&quot;: { # Describes an RSA key that may be used in a Certificate issued from a CaPool. # Represents an allowed RSA key type.
-          &quot;maxModulusSize&quot;: &quot;A String&quot;, # Optional. The maximum allowed RSA modulus size, in bits. If this is not set, or if set to zero, the service will not enforce an explicit upper bound on RSA modulus sizes.
-          &quot;minModulusSize&quot;: &quot;A String&quot;, # Optional. The minimum allowed RSA modulus size, in bits. If this is not set, or if set to zero, the service-level min RSA modulus size will continue to apply.
+          &quot;maxModulusSize&quot;: &quot;A String&quot;, # Optional. The maximum allowed RSA modulus size (inclusive), in bits. If this is not set, or if set to zero, the service will not enforce an explicit upper bound on RSA modulus sizes.
+          &quot;minModulusSize&quot;: &quot;A String&quot;, # Optional. The minimum allowed RSA modulus size (inclusive), in bits. If this is not set, or if set to zero, the service-level min RSA modulus size will continue to apply.
         },
       },
     ],
@@ -364,8 +364,8 @@
           &quot;signatureAlgorithm&quot;: &quot;A String&quot;, # Optional. A signature algorithm that must be used. If this is omitted, any EC-based signature algorithm will be allowed.
         },
         &quot;rsa&quot;: { # Describes an RSA key that may be used in a Certificate issued from a CaPool. # Represents an allowed RSA key type.
-          &quot;maxModulusSize&quot;: &quot;A String&quot;, # Optional. The maximum allowed RSA modulus size, in bits. If this is not set, or if set to zero, the service will not enforce an explicit upper bound on RSA modulus sizes.
-          &quot;minModulusSize&quot;: &quot;A String&quot;, # Optional. The minimum allowed RSA modulus size, in bits. If this is not set, or if set to zero, the service-level min RSA modulus size will continue to apply.
+          &quot;maxModulusSize&quot;: &quot;A String&quot;, # Optional. The maximum allowed RSA modulus size (inclusive), in bits. If this is not set, or if set to zero, the service will not enforce an explicit upper bound on RSA modulus sizes.
+          &quot;minModulusSize&quot;: &quot;A String&quot;, # Optional. The minimum allowed RSA modulus size (inclusive), in bits. If this is not set, or if set to zero, the service-level min RSA modulus size will continue to apply.
         },
       },
     ],
@@ -540,8 +540,8 @@
               &quot;signatureAlgorithm&quot;: &quot;A String&quot;, # Optional. A signature algorithm that must be used. If this is omitted, any EC-based signature algorithm will be allowed.
             },
             &quot;rsa&quot;: { # Describes an RSA key that may be used in a Certificate issued from a CaPool. # Represents an allowed RSA key type.
-              &quot;maxModulusSize&quot;: &quot;A String&quot;, # Optional. The maximum allowed RSA modulus size, in bits. If this is not set, or if set to zero, the service will not enforce an explicit upper bound on RSA modulus sizes.
-              &quot;minModulusSize&quot;: &quot;A String&quot;, # Optional. The minimum allowed RSA modulus size, in bits. If this is not set, or if set to zero, the service-level min RSA modulus size will continue to apply.
+              &quot;maxModulusSize&quot;: &quot;A String&quot;, # Optional. The maximum allowed RSA modulus size (inclusive), in bits. If this is not set, or if set to zero, the service will not enforce an explicit upper bound on RSA modulus sizes.
+              &quot;minModulusSize&quot;: &quot;A String&quot;, # Optional. The minimum allowed RSA modulus size (inclusive), in bits. If this is not set, or if set to zero, the service-level min RSA modulus size will continue to apply.
             },
           },
         ],
@@ -677,8 +677,8 @@
           &quot;signatureAlgorithm&quot;: &quot;A String&quot;, # Optional. A signature algorithm that must be used. If this is omitted, any EC-based signature algorithm will be allowed.
         },
         &quot;rsa&quot;: { # Describes an RSA key that may be used in a Certificate issued from a CaPool. # Represents an allowed RSA key type.
-          &quot;maxModulusSize&quot;: &quot;A String&quot;, # Optional. The maximum allowed RSA modulus size, in bits. If this is not set, or if set to zero, the service will not enforce an explicit upper bound on RSA modulus sizes.
-          &quot;minModulusSize&quot;: &quot;A String&quot;, # Optional. The minimum allowed RSA modulus size, in bits. If this is not set, or if set to zero, the service-level min RSA modulus size will continue to apply.
+          &quot;maxModulusSize&quot;: &quot;A String&quot;, # Optional. The maximum allowed RSA modulus size (inclusive), in bits. If this is not set, or if set to zero, the service will not enforce an explicit upper bound on RSA modulus sizes.
+          &quot;minModulusSize&quot;: &quot;A String&quot;, # Optional. The minimum allowed RSA modulus size (inclusive), in bits. If this is not set, or if set to zero, the service-level min RSA modulus size will continue to apply.
         },
       },
     ],
diff --git a/docs/dyn/realtimebidding_v1.bidders.creatives.html b/docs/dyn/realtimebidding_v1.bidders.creatives.html
index e42ed5c..1d7cfa8 100644
--- a/docs/dyn/realtimebidding_v1.bidders.creatives.html
+++ b/docs/dyn/realtimebidding_v1.bidders.creatives.html
@@ -100,7 +100,7 @@
   parent: string, Required. Name of the parent buyer that owns the creatives. The pattern for this resource is either `buyers/{buyerAccountId}` or `bidders/{bidderAccountId}`. For `buyers/{buyerAccountId}`, the `buyerAccountId` can be one of the following: 1. The ID of the buyer that is accessing their own creatives. 2. The ID of the child seat buyer under a bidder account. So for listing creatives pertaining to the child seat buyer (`456`) under bidder account (`123`), you would use the pattern: `buyers/456`. 3. The ID of the bidder itself. So for listing creatives pertaining to bidder (`123`), you would use `buyers/123`. If you want to access all creatives pertaining to both the bidder and all of its child seat accounts, you would use `bidders/{bidderAccountId}`, e.g., for all creatives pertaining to bidder (`123`), use `bidders/123`. (required)
   filter: string, Query string to filter creatives. If no filter is specified, all active creatives will be returned. Example: &#x27;accountId=12345 AND (dealsStatus:DISAPPROVED AND disapprovalReason:UNACCEPTABLE_CONTENT) OR declaredAttributes:IS_COOKIE_TARGETED&#x27;
   pageSize: integer, Requested page size. The server may return fewer creatives than requested (due to timeout constraint) even if more are available via another call. If unspecified, server will pick an appropriate default. Acceptable values are 1 to 1000, inclusive.
-  pageToken: string, A token identifying a page of results the server should return. Typically, this is the value of ListCreativesResponse.nextPageToken returned from the previous call to the &#x27;ListCreatives&#x27; method.
+  pageToken: string, A token identifying a page of results the server should return. Typically, this is the value of ListCreativesResponse.nextPageToken returned from the previous call to the &#x27;ListCreatives&#x27; method. Page tokens for continued pages are valid for up to five hours, counting from the call to &#x27;ListCreatives&#x27; for the first page.
   view: string, Controls the amount of information included in the response. By default only creativeServingDecision is included. To retrieve the entire creative resource (including the declared fields and the creative content) specify the view as &quot;FULL&quot;.
     Allowed values
       CREATIVE_VIEW_UNSPECIFIED - Not specified, equivalent to SERVING_DECISION_ONLY.
diff --git a/docs/dyn/realtimebidding_v1.buyers.creatives.html b/docs/dyn/realtimebidding_v1.buyers.creatives.html
index 6aaad3f..98b8793 100644
--- a/docs/dyn/realtimebidding_v1.buyers.creatives.html
+++ b/docs/dyn/realtimebidding_v1.buyers.creatives.html
@@ -1419,7 +1419,7 @@
   parent: string, Required. Name of the parent buyer that owns the creatives. The pattern for this resource is either `buyers/{buyerAccountId}` or `bidders/{bidderAccountId}`. For `buyers/{buyerAccountId}`, the `buyerAccountId` can be one of the following: 1. The ID of the buyer that is accessing their own creatives. 2. The ID of the child seat buyer under a bidder account. So for listing creatives pertaining to the child seat buyer (`456`) under bidder account (`123`), you would use the pattern: `buyers/456`. 3. The ID of the bidder itself. So for listing creatives pertaining to bidder (`123`), you would use `buyers/123`. If you want to access all creatives pertaining to both the bidder and all of its child seat accounts, you would use `bidders/{bidderAccountId}`, e.g., for all creatives pertaining to bidder (`123`), use `bidders/123`. (required)
   filter: string, Query string to filter creatives. If no filter is specified, all active creatives will be returned. Example: &#x27;accountId=12345 AND (dealsStatus:DISAPPROVED AND disapprovalReason:UNACCEPTABLE_CONTENT) OR declaredAttributes:IS_COOKIE_TARGETED&#x27;
   pageSize: integer, Requested page size. The server may return fewer creatives than requested (due to timeout constraint) even if more are available via another call. If unspecified, server will pick an appropriate default. Acceptable values are 1 to 1000, inclusive.
-  pageToken: string, A token identifying a page of results the server should return. Typically, this is the value of ListCreativesResponse.nextPageToken returned from the previous call to the &#x27;ListCreatives&#x27; method.
+  pageToken: string, A token identifying a page of results the server should return. Typically, this is the value of ListCreativesResponse.nextPageToken returned from the previous call to the &#x27;ListCreatives&#x27; method. Page tokens for continued pages are valid for up to five hours, counting from the call to &#x27;ListCreatives&#x27; for the first page.
   view: string, Controls the amount of information included in the response. By default only creativeServingDecision is included. To retrieve the entire creative resource (including the declared fields and the creative content) specify the view as &quot;FULL&quot;.
     Allowed values
       CREATIVE_VIEW_UNSPECIFIED - Not specified, equivalent to SERVING_DECISION_ONLY.
diff --git a/docs/dyn/retail_v2.projects.locations.catalogs.branches.products.html b/docs/dyn/retail_v2.projects.locations.catalogs.branches.products.html
index f19aa2b..5e413ac 100644
--- a/docs/dyn/retail_v2.projects.locations.catalogs.branches.products.html
+++ b/docs/dyn/retail_v2.projects.locations.catalogs.branches.products.html
@@ -119,7 +119,7 @@
 
 { # Request message for AddFulfillmentPlaces method.
   &quot;addTime&quot;: &quot;A String&quot;, # The time when the fulfillment updates are issued, used to prevent out-of-order updates on fulfillment information. If not provided, the internal system time will be used.
-  &quot;allowMissing&quot;: True or False, # If set to true, and the Product is not found, the fulfillment information will still be processed and retained for at most 1 day and processed once the Product is created. If set to false, an INVALID_ARGUMENT error is returned if the Product is not found.
+  &quot;allowMissing&quot;: True or False, # If set to true, and the Product is not found, the fulfillment information will still be processed and retained for at most 1 day and processed once the Product is created. If set to false, a NOT_FOUND error is returned if the Product is not found.
   &quot;placeIds&quot;: [ # Required. The IDs for this type, such as the store IDs for &quot;pickup-in-store&quot; or the region IDs for &quot;same-day-delivery&quot; to be added for this type. Duplicate IDs will be automatically ignored. At least 1 value is required, and a maximum of 2000 values are allowed. Each value must be a string with a length limit of 10 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned. If the total number of place IDs exceeds 2000 for this type after adding, then the update will be rejected.
     &quot;A String&quot;,
   ],
@@ -214,7 +214,7 @@
     &quot;A String&quot;,
   ],
   &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-  &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+  &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
   &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
     { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
       &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -346,7 +346,7 @@
     &quot;A String&quot;,
   ],
   &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-  &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+  &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
   &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
     { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
       &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -502,7 +502,7 @@
     &quot;A String&quot;,
   ],
   &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-  &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+  &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
   &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
     { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
       &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -660,7 +660,7 @@
             &quot;A String&quot;,
           ],
           &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-          &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+          &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
           &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
             { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
               &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -841,7 +841,7 @@
         &quot;A String&quot;,
       ],
       &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-      &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+      &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
       &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
         { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
           &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -990,7 +990,7 @@
     &quot;A String&quot;,
   ],
   &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-  &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+  &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
   &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
     { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
       &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -1123,7 +1123,7 @@
     &quot;A String&quot;,
   ],
   &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-  &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+  &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
   &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
     { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
       &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -1212,7 +1212,7 @@
     The object takes the form of:
 
 { # Request message for RemoveFulfillmentPlaces method.
-  &quot;allowMissing&quot;: True or False, # If set to true, and the Product is not found, the fulfillment information will still be processed and retained for at most 1 day and processed once the Product is created. If set to false, an INVALID_ARGUMENT error is returned if the Product is not found.
+  &quot;allowMissing&quot;: True or False, # If set to true, and the Product is not found, the fulfillment information will still be processed and retained for at most 1 day and processed once the Product is created. If set to false, a NOT_FOUND error is returned if the Product is not found.
   &quot;placeIds&quot;: [ # Required. The IDs for this type, such as the store IDs for &quot;pickup-in-store&quot; or the region IDs for &quot;same-day-delivery&quot;, to be removed for this type. At least 1 value is required, and a maximum of 2000 values are allowed. Each value must be a string with a length limit of 10 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
     &quot;A String&quot;,
   ],
@@ -1259,7 +1259,7 @@
     The object takes the form of:
 
 { # Request message for SetInventory method.
-  &quot;allowMissing&quot;: True or False, # If set to true, and the Product with name Product.name is not found, the inventory update will still be processed and retained for at most 1 day until the Product is created. If set to false, an INVALID_ARGUMENT error is returned if the Product is not found.
+  &quot;allowMissing&quot;: True or False, # If set to true, and the Product with name Product.name is not found, the inventory update will still be processed and retained for at most 1 day until the Product is created. If set to false, a NOT_FOUND error is returned if the Product is not found.
   &quot;inventory&quot;: { # Product captures all metadata information of items to be recommended or searched. # Required. The inventory information to update. The allowable fields to update are: * Product.price_info * Product.availability * Product.available_quantity * Product.fulfillment_info The updated inventory fields must be specified in SetInventoryRequest.set_mask. If SetInventoryRequest.inventory.name is empty or invalid, an INVALID_ARGUMENT error is returned. If the caller does not have permission to update the Product named in Product.name, regardless of whether or not it exists, a PERMISSION_DENIED error is returned. If the Product to update does not have existing inventory information, the provided inventory information will be inserted. If the Product to update has existing inventory information, the provided inventory information will be merged while respecting the last update time for each inventory field, using the provided or default value for SetInventoryRequest.set_time. The last update time is recorded for the following inventory fields: * Product.price_info * Product.availability * Product.available_quantity * Product.fulfillment_info If a full overwrite of inventory information while ignoring timestamps is needed, UpdateProduct should be invoked instead.
     &quot;attributes&quot;: { # Highly encouraged. Extra product attributes to be included. For example, for products, this could include the store name, vendor, style, color, etc. These are very strong signals for recommendation model, thus we highly recommend providing the attributes here. Features that can take on one of a limited number of possible values. Two types of features can be set are: Textual features. some examples would be the brand/maker of a product, or country of a customer. Numerical features. Some examples would be the height/weight of a product, or age of a customer. For example: `{ &quot;vendor&quot;: {&quot;text&quot;: [&quot;vendor123&quot;, &quot;vendor456&quot;]}, &quot;lengths_cm&quot;: {&quot;numbers&quot;:[2.3, 15.4]}, &quot;heights_cm&quot;: {&quot;numbers&quot;:[8.1, 6.4]} }`. This field needs to pass all below criteria, otherwise an INVALID_ARGUMENT error is returned: * Max entries count: 200. * The key must be a UTF-8 encoded string with a length limit of 128 characters. * For indexable attribute, the key must match the pattern: a-zA-Z0-9*. For example, key0LikeThis or KEY_1_LIKE_THIS.
       &quot;a_key&quot;: { # A custom attribute that is not explicitly modeled in Product.
@@ -1305,7 +1305,7 @@
       &quot;A String&quot;,
     ],
     &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-    &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+    &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
     &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
       { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
         &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
diff --git a/docs/dyn/retail_v2.projects.locations.catalogs.placements.html b/docs/dyn/retail_v2.projects.locations.catalogs.placements.html
index 3225181..263da16 100644
--- a/docs/dyn/retail_v2.projects.locations.catalogs.placements.html
+++ b/docs/dyn/retail_v2.projects.locations.catalogs.placements.html
@@ -190,7 +190,7 @@
             &quot;A String&quot;,
           ],
           &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-          &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+          &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
           &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
             { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
               &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -483,7 +483,7 @@
           &quot;A String&quot;,
         ],
         &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-        &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+        &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
         &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
           { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
             &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
diff --git a/docs/dyn/retail_v2.projects.locations.catalogs.userEvents.html b/docs/dyn/retail_v2.projects.locations.catalogs.userEvents.html
index 0d720ad..28db910 100644
--- a/docs/dyn/retail_v2.projects.locations.catalogs.userEvents.html
+++ b/docs/dyn/retail_v2.projects.locations.catalogs.userEvents.html
@@ -239,7 +239,7 @@
                   &quot;A String&quot;,
                 ],
                 &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-                &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+                &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
                 &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
                   { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
                     &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -545,7 +545,7 @@
           &quot;A String&quot;,
         ],
         &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-        &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+        &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
         &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
           { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
             &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -732,7 +732,7 @@
           &quot;A String&quot;,
         ],
         &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-        &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+        &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
         &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
           { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
             &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
diff --git a/docs/dyn/retail_v2alpha.projects.locations.catalogs.branches.products.html b/docs/dyn/retail_v2alpha.projects.locations.catalogs.branches.products.html
index 485e5e4..881c613 100644
--- a/docs/dyn/retail_v2alpha.projects.locations.catalogs.branches.products.html
+++ b/docs/dyn/retail_v2alpha.projects.locations.catalogs.branches.products.html
@@ -119,7 +119,7 @@
 
 { # Request message for AddFulfillmentPlaces method.
   &quot;addTime&quot;: &quot;A String&quot;, # The time when the fulfillment updates are issued, used to prevent out-of-order updates on fulfillment information. If not provided, the internal system time will be used.
-  &quot;allowMissing&quot;: True or False, # If set to true, and the Product is not found, the fulfillment information will still be processed and retained for at most 1 day and processed once the Product is created. If set to false, an INVALID_ARGUMENT error is returned if the Product is not found.
+  &quot;allowMissing&quot;: True or False, # If set to true, and the Product is not found, the fulfillment information will still be processed and retained for at most 1 day and processed once the Product is created. If set to false, a NOT_FOUND error is returned if the Product is not found.
   &quot;placeIds&quot;: [ # Required. The IDs for this type, such as the store IDs for &quot;pickup-in-store&quot; or the region IDs for &quot;same-day-delivery&quot; to be added for this type. Duplicate IDs will be automatically ignored. At least 1 value is required, and a maximum of 2000 values are allowed. Each value must be a string with a length limit of 10 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned. If the total number of place IDs exceeds 2000 for this type after adding, then the update will be rejected.
     &quot;A String&quot;,
   ],
@@ -214,7 +214,7 @@
     &quot;A String&quot;,
   ],
   &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-  &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+  &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
   &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
     { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
       &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -346,7 +346,7 @@
     &quot;A String&quot;,
   ],
   &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-  &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+  &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
   &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
     { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
       &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -502,7 +502,7 @@
     &quot;A String&quot;,
   ],
   &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-  &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+  &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
   &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
     { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
       &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -660,7 +660,7 @@
             &quot;A String&quot;,
           ],
           &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-          &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+          &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
           &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
             { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
               &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -842,7 +842,7 @@
         &quot;A String&quot;,
       ],
       &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-      &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+      &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
       &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
         { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
           &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -992,7 +992,7 @@
     &quot;A String&quot;,
   ],
   &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-  &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+  &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
   &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
     { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
       &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -1125,7 +1125,7 @@
     &quot;A String&quot;,
   ],
   &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-  &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+  &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
   &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
     { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
       &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -1214,7 +1214,7 @@
     The object takes the form of:
 
 { # Request message for RemoveFulfillmentPlaces method.
-  &quot;allowMissing&quot;: True or False, # If set to true, and the Product is not found, the fulfillment information will still be processed and retained for at most 1 day and processed once the Product is created. If set to false, an INVALID_ARGUMENT error is returned if the Product is not found.
+  &quot;allowMissing&quot;: True or False, # If set to true, and the Product is not found, the fulfillment information will still be processed and retained for at most 1 day and processed once the Product is created. If set to false, a NOT_FOUND error is returned if the Product is not found.
   &quot;placeIds&quot;: [ # Required. The IDs for this type, such as the store IDs for &quot;pickup-in-store&quot; or the region IDs for &quot;same-day-delivery&quot;, to be removed for this type. At least 1 value is required, and a maximum of 2000 values are allowed. Each value must be a string with a length limit of 10 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
     &quot;A String&quot;,
   ],
@@ -1261,7 +1261,7 @@
     The object takes the form of:
 
 { # Request message for SetInventory method.
-  &quot;allowMissing&quot;: True or False, # If set to true, and the Product with name Product.name is not found, the inventory update will still be processed and retained for at most 1 day until the Product is created. If set to false, an INVALID_ARGUMENT error is returned if the Product is not found.
+  &quot;allowMissing&quot;: True or False, # If set to true, and the Product with name Product.name is not found, the inventory update will still be processed and retained for at most 1 day until the Product is created. If set to false, a NOT_FOUND error is returned if the Product is not found.
   &quot;inventory&quot;: { # Product captures all metadata information of items to be recommended or searched. # Required. The inventory information to update. The allowable fields to update are: * Product.price_info * Product.availability * Product.available_quantity * Product.fulfillment_info The updated inventory fields must be specified in SetInventoryRequest.set_mask. If SetInventoryRequest.inventory.name is empty or invalid, an INVALID_ARGUMENT error is returned. If the caller does not have permission to update the Product named in Product.name, regardless of whether or not it exists, a PERMISSION_DENIED error is returned. If the Product to update does not have existing inventory information, the provided inventory information will be inserted. If the Product to update has existing inventory information, the provided inventory information will be merged while respecting the last update time for each inventory field, using the provided or default value for SetInventoryRequest.set_time. The last update time is recorded for the following inventory fields: * Product.price_info * Product.availability * Product.available_quantity * Product.fulfillment_info If a full overwrite of inventory information while ignoring timestamps is needed, UpdateProduct should be invoked instead.
     &quot;attributes&quot;: { # Highly encouraged. Extra product attributes to be included. For example, for products, this could include the store name, vendor, style, color, etc. These are very strong signals for recommendation model, thus we highly recommend providing the attributes here. Features that can take on one of a limited number of possible values. Two types of features can be set are: Textual features. some examples would be the brand/maker of a product, or country of a customer. Numerical features. Some examples would be the height/weight of a product, or age of a customer. For example: `{ &quot;vendor&quot;: {&quot;text&quot;: [&quot;vendor123&quot;, &quot;vendor456&quot;]}, &quot;lengths_cm&quot;: {&quot;numbers&quot;:[2.3, 15.4]}, &quot;heights_cm&quot;: {&quot;numbers&quot;:[8.1, 6.4]} }`. This field needs to pass all below criteria, otherwise an INVALID_ARGUMENT error is returned: * Max entries count: 200. * The key must be a UTF-8 encoded string with a length limit of 128 characters. * For indexable attribute, the key must match the pattern: a-zA-Z0-9*. For example, key0LikeThis or KEY_1_LIKE_THIS.
       &quot;a_key&quot;: { # A custom attribute that is not explicitly modeled in Product.
@@ -1307,7 +1307,7 @@
       &quot;A String&quot;,
     ],
     &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-    &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+    &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
     &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
       { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
         &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
diff --git a/docs/dyn/retail_v2alpha.projects.locations.catalogs.placements.html b/docs/dyn/retail_v2alpha.projects.locations.catalogs.placements.html
index 46db30a..eeec422 100644
--- a/docs/dyn/retail_v2alpha.projects.locations.catalogs.placements.html
+++ b/docs/dyn/retail_v2alpha.projects.locations.catalogs.placements.html
@@ -190,7 +190,7 @@
             &quot;A String&quot;,
           ],
           &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-          &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+          &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
           &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
             { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
               &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -484,7 +484,7 @@
           &quot;A String&quot;,
         ],
         &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-        &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+        &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
         &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
           { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
             &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
diff --git a/docs/dyn/retail_v2alpha.projects.locations.catalogs.userEvents.html b/docs/dyn/retail_v2alpha.projects.locations.catalogs.userEvents.html
index 6307920..c7e6c2a 100644
--- a/docs/dyn/retail_v2alpha.projects.locations.catalogs.userEvents.html
+++ b/docs/dyn/retail_v2alpha.projects.locations.catalogs.userEvents.html
@@ -239,7 +239,7 @@
                   &quot;A String&quot;,
                 ],
                 &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-                &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+                &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
                 &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
                   { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
                     &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -545,7 +545,7 @@
           &quot;A String&quot;,
         ],
         &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-        &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+        &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
         &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
           { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
             &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -732,7 +732,7 @@
           &quot;A String&quot;,
         ],
         &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-        &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+        &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
         &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
           { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
             &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
diff --git a/docs/dyn/retail_v2beta.projects.locations.catalogs.branches.products.html b/docs/dyn/retail_v2beta.projects.locations.catalogs.branches.products.html
index 21286a2..ff7eaaa 100644
--- a/docs/dyn/retail_v2beta.projects.locations.catalogs.branches.products.html
+++ b/docs/dyn/retail_v2beta.projects.locations.catalogs.branches.products.html
@@ -119,7 +119,7 @@
 
 { # Request message for AddFulfillmentPlaces method.
   &quot;addTime&quot;: &quot;A String&quot;, # The time when the fulfillment updates are issued, used to prevent out-of-order updates on fulfillment information. If not provided, the internal system time will be used.
-  &quot;allowMissing&quot;: True or False, # If set to true, and the Product is not found, the fulfillment information will still be processed and retained for at most 1 day and processed once the Product is created. If set to false, an INVALID_ARGUMENT error is returned if the Product is not found.
+  &quot;allowMissing&quot;: True or False, # If set to true, and the Product is not found, the fulfillment information will still be processed and retained for at most 1 day and processed once the Product is created. If set to false, a NOT_FOUND error is returned if the Product is not found.
   &quot;placeIds&quot;: [ # Required. The IDs for this type, such as the store IDs for &quot;pickup-in-store&quot; or the region IDs for &quot;same-day-delivery&quot; to be added for this type. Duplicate IDs will be automatically ignored. At least 1 value is required, and a maximum of 2000 values are allowed. Each value must be a string with a length limit of 10 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned. If the total number of place IDs exceeds 2000 for this type after adding, then the update will be rejected.
     &quot;A String&quot;,
   ],
@@ -214,7 +214,7 @@
     &quot;A String&quot;,
   ],
   &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-  &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+  &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
   &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
     { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
       &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -346,7 +346,7 @@
     &quot;A String&quot;,
   ],
   &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-  &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+  &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
   &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
     { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
       &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -502,7 +502,7 @@
     &quot;A String&quot;,
   ],
   &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-  &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+  &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
   &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
     { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
       &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -660,7 +660,7 @@
             &quot;A String&quot;,
           ],
           &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-          &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+          &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
           &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
             { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
               &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -841,7 +841,7 @@
         &quot;A String&quot;,
       ],
       &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-      &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+      &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
       &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
         { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
           &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -990,7 +990,7 @@
     &quot;A String&quot;,
   ],
   &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-  &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+  &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
   &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
     { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
       &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -1123,7 +1123,7 @@
     &quot;A String&quot;,
   ],
   &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-  &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+  &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
   &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
     { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
       &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -1212,7 +1212,7 @@
     The object takes the form of:
 
 { # Request message for RemoveFulfillmentPlaces method.
-  &quot;allowMissing&quot;: True or False, # If set to true, and the Product is not found, the fulfillment information will still be processed and retained for at most 1 day and processed once the Product is created. If set to false, an INVALID_ARGUMENT error is returned if the Product is not found.
+  &quot;allowMissing&quot;: True or False, # If set to true, and the Product is not found, the fulfillment information will still be processed and retained for at most 1 day and processed once the Product is created. If set to false, a NOT_FOUND error is returned if the Product is not found.
   &quot;placeIds&quot;: [ # Required. The IDs for this type, such as the store IDs for &quot;pickup-in-store&quot; or the region IDs for &quot;same-day-delivery&quot;, to be removed for this type. At least 1 value is required, and a maximum of 2000 values are allowed. Each value must be a string with a length limit of 10 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
     &quot;A String&quot;,
   ],
@@ -1259,7 +1259,7 @@
     The object takes the form of:
 
 { # Request message for SetInventory method.
-  &quot;allowMissing&quot;: True or False, # If set to true, and the Product with name Product.name is not found, the inventory update will still be processed and retained for at most 1 day until the Product is created. If set to false, an INVALID_ARGUMENT error is returned if the Product is not found.
+  &quot;allowMissing&quot;: True or False, # If set to true, and the Product with name Product.name is not found, the inventory update will still be processed and retained for at most 1 day until the Product is created. If set to false, a NOT_FOUND error is returned if the Product is not found.
   &quot;inventory&quot;: { # Product captures all metadata information of items to be recommended or searched. # Required. The inventory information to update. The allowable fields to update are: * Product.price_info * Product.availability * Product.available_quantity * Product.fulfillment_info The updated inventory fields must be specified in SetInventoryRequest.set_mask. If SetInventoryRequest.inventory.name is empty or invalid, an INVALID_ARGUMENT error is returned. If the caller does not have permission to update the Product named in Product.name, regardless of whether or not it exists, a PERMISSION_DENIED error is returned. If the Product to update does not have existing inventory information, the provided inventory information will be inserted. If the Product to update has existing inventory information, the provided inventory information will be merged while respecting the last update time for each inventory field, using the provided or default value for SetInventoryRequest.set_time. The last update time is recorded for the following inventory fields: * Product.price_info * Product.availability * Product.available_quantity * Product.fulfillment_info If a full overwrite of inventory information while ignoring timestamps is needed, UpdateProduct should be invoked instead.
     &quot;attributes&quot;: { # Highly encouraged. Extra product attributes to be included. For example, for products, this could include the store name, vendor, style, color, etc. These are very strong signals for recommendation model, thus we highly recommend providing the attributes here. Features that can take on one of a limited number of possible values. Two types of features can be set are: Textual features. some examples would be the brand/maker of a product, or country of a customer. Numerical features. Some examples would be the height/weight of a product, or age of a customer. For example: `{ &quot;vendor&quot;: {&quot;text&quot;: [&quot;vendor123&quot;, &quot;vendor456&quot;]}, &quot;lengths_cm&quot;: {&quot;numbers&quot;:[2.3, 15.4]}, &quot;heights_cm&quot;: {&quot;numbers&quot;:[8.1, 6.4]} }`. This field needs to pass all below criteria, otherwise an INVALID_ARGUMENT error is returned: * Max entries count: 200. * The key must be a UTF-8 encoded string with a length limit of 128 characters. * For indexable attribute, the key must match the pattern: a-zA-Z0-9*. For example, key0LikeThis or KEY_1_LIKE_THIS.
       &quot;a_key&quot;: { # A custom attribute that is not explicitly modeled in Product.
@@ -1305,7 +1305,7 @@
       &quot;A String&quot;,
     ],
     &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-    &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+    &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
     &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
       { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
         &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
diff --git a/docs/dyn/retail_v2beta.projects.locations.catalogs.placements.html b/docs/dyn/retail_v2beta.projects.locations.catalogs.placements.html
index ebccfc2..bfcaaf9 100644
--- a/docs/dyn/retail_v2beta.projects.locations.catalogs.placements.html
+++ b/docs/dyn/retail_v2beta.projects.locations.catalogs.placements.html
@@ -190,7 +190,7 @@
             &quot;A String&quot;,
           ],
           &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-          &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+          &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
           &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
             { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
               &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -483,7 +483,7 @@
           &quot;A String&quot;,
         ],
         &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-        &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+        &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
         &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
           { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
             &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
diff --git a/docs/dyn/retail_v2beta.projects.locations.catalogs.userEvents.html b/docs/dyn/retail_v2beta.projects.locations.catalogs.userEvents.html
index 512939a..22c3378 100644
--- a/docs/dyn/retail_v2beta.projects.locations.catalogs.userEvents.html
+++ b/docs/dyn/retail_v2beta.projects.locations.catalogs.userEvents.html
@@ -239,7 +239,7 @@
                   &quot;A String&quot;,
                 ],
                 &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-                &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+                &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
                 &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
                   { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
                     &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -545,7 +545,7 @@
           &quot;A String&quot;,
         ],
         &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-        &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+        &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
         &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
           { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
             &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
@@ -732,7 +732,7 @@
           &quot;A String&quot;,
         ],
         &quot;description&quot;: &quot;A String&quot;, # Product description. This field must be a UTF-8 encoded string with a length limit of 5,000 characters. Otherwise, an INVALID_ARGUMENT error is returned. Google Merchant Center property [description](https://support.google.com/merchants/answer/6324468). schema.org property [Product.description](https://schema.org/description).
-        &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
+        &quot;expireTime&quot;: &quot;A String&quot;, # The timestamp when this product becomes unavailable for SearchService.Search. If it is set, the Product is not available for SearchService.Search after expire_time. However, the product can still be retrieved by ProductService.GetProduct and ProductService.ListProducts. expire_time must be later than available_time and publish_time, otherwise an INVALID_ARGUMENT error is thrown. Google Merchant Center property [expiration_date](https://support.google.com/merchants/answer/6324499).
         &quot;fulfillmentInfo&quot;: [ # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods. All the elements must have distinct FulfillmentInfo.type. Otherwise, an INVALID_ARGUMENT error is returned.
           { # Fulfillment information, such as the store IDs for in-store pickup or region IDs for different shipping methods.
             &quot;placeIds&quot;: [ # The IDs for this type, such as the store IDs for FulfillmentInfo.type.pickup-in-store or the region IDs for FulfillmentInfo.type.same-day-delivery. A maximum of 3000 values are allowed. Each value must be a string with a length limit of 30 characters, matching the pattern [a-zA-Z0-9_-]+, such as &quot;store1&quot; or &quot;REGION-2&quot;. Otherwise, an INVALID_ARGUMENT error is returned.
diff --git a/docs/dyn/runtimeconfig_v1beta1.projects.configs.html b/docs/dyn/runtimeconfig_v1beta1.projects.configs.html
index 4fbc327..4f6fdc9 100644
--- a/docs/dyn/runtimeconfig_v1beta1.projects.configs.html
+++ b/docs/dyn/runtimeconfig_v1beta1.projects.configs.html
@@ -208,7 +208,7 @@
   An object of the form:
 
     { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
-  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member. The `bindings` in a `Policy` can refer to up to 1,500 members; up to 250 of these members can be Google groups. Each occurrence of a member counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other member, then you can add another 1,450 members to the `bindings` in the `Policy`.
     { # Associates `members` with a `role`.
       &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
         &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
@@ -279,7 +279,7 @@
 
 { # Request message for `SetIamPolicy` method.
   &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
-    &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+    &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member. The `bindings` in a `Policy` can refer to up to 1,500 members; up to 250 of these members can be Google groups. Each occurrence of a member counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other member, then you can add another 1,450 members to the `bindings` in the `Policy`.
       { # Associates `members` with a `role`.
         &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
           &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
@@ -307,7 +307,7 @@
   An object of the form:
 
     { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
-  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member. The `bindings` in a `Policy` can refer to up to 1,500 members; up to 250 of these members can be Google groups. Each occurrence of a member counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other member, then you can add another 1,450 members to the `bindings` in the `Policy`.
     { # Associates `members` with a `role`.
       &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
         &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
diff --git a/docs/dyn/servicecontrol_v2.services.html b/docs/dyn/servicecontrol_v2.services.html
index e821447..c218f34 100644
--- a/docs/dyn/servicecontrol_v2.services.html
+++ b/docs/dyn/servicecontrol_v2.services.html
@@ -166,7 +166,7 @@
       &quot;location&quot;: &quot;A String&quot;, # Immutable. The location of the resource. The location encoding is specific to the service provider, and new encoding may be introduced as the service evolves. For Google Cloud products, the encoding is what is used by Google Cloud APIs, such as `us-east1`, `aws-us-east-1`, and `azure-eastus2`. The semantics of `location` is identical to the `cloud.googleapis.com/location` label used by some Google Cloud APIs.
       &quot;name&quot;: &quot;A String&quot;, # The stable identifier (name) of a resource on the `service`. A resource can be logically identified as &quot;//{resource.service}/{resource.name}&quot;. The differences between a resource name and a URI are: * Resource name is a logical identifier, independent of network protocol and API version. For example, `//pubsub.googleapis.com/projects/123/topics/news-feed`. * URI often includes protocol and version information, so it can be used directly by applications. For example, `https://pubsub.googleapis.com/v1/projects/123/topics/news-feed`. See https://cloud.google.com/apis/design/resource_names for details.
       &quot;service&quot;: &quot;A String&quot;, # The name of the service that this resource belongs to, such as `pubsub.googleapis.com`. The service may be different from the DNS hostname that actually serves the request.
-      &quot;type&quot;: &quot;A String&quot;, # The type of the resource. The syntax is platform-specific because different platforms define their resources differently. For Google APIs, the type format must be &quot;{service}/{kind}&quot;.
+      &quot;type&quot;: &quot;A String&quot;, # The type of the resource. The syntax is platform-specific because different platforms define their resources differently. For Google APIs, the type format must be &quot;{service}/{kind}&quot;, such as &quot;pubsub.googleapis.com/Topic&quot;.
       &quot;uid&quot;: &quot;A String&quot;, # The unique identifier of the resource. UID is unique in the time and space for this resource within the scope of the service. It is typically generated by the server on successful creation of a resource and must not be changed. UID is used to uniquely identify resources with resource name reuses. This should be a UUID4.
       &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The timestamp when the resource was last updated. Any change to the resource made by users must refresh this value. Changes to a resource made by the service should refresh this value.
     },
@@ -314,7 +314,7 @@
         &quot;location&quot;: &quot;A String&quot;, # Immutable. The location of the resource. The location encoding is specific to the service provider, and new encoding may be introduced as the service evolves. For Google Cloud products, the encoding is what is used by Google Cloud APIs, such as `us-east1`, `aws-us-east-1`, and `azure-eastus2`. The semantics of `location` is identical to the `cloud.googleapis.com/location` label used by some Google Cloud APIs.
         &quot;name&quot;: &quot;A String&quot;, # The stable identifier (name) of a resource on the `service`. A resource can be logically identified as &quot;//{resource.service}/{resource.name}&quot;. The differences between a resource name and a URI are: * Resource name is a logical identifier, independent of network protocol and API version. For example, `//pubsub.googleapis.com/projects/123/topics/news-feed`. * URI often includes protocol and version information, so it can be used directly by applications. For example, `https://pubsub.googleapis.com/v1/projects/123/topics/news-feed`. See https://cloud.google.com/apis/design/resource_names for details.
         &quot;service&quot;: &quot;A String&quot;, # The name of the service that this resource belongs to, such as `pubsub.googleapis.com`. The service may be different from the DNS hostname that actually serves the request.
-        &quot;type&quot;: &quot;A String&quot;, # The type of the resource. The syntax is platform-specific because different platforms define their resources differently. For Google APIs, the type format must be &quot;{service}/{kind}&quot;.
+        &quot;type&quot;: &quot;A String&quot;, # The type of the resource. The syntax is platform-specific because different platforms define their resources differently. For Google APIs, the type format must be &quot;{service}/{kind}&quot;, such as &quot;pubsub.googleapis.com/Topic&quot;.
         &quot;uid&quot;: &quot;A String&quot;, # The unique identifier of the resource. UID is unique in the time and space for this resource within the scope of the service. It is typically generated by the server on successful creation of a resource and must not be changed. UID is used to uniquely identify resources with resource name reuses. This should be a UUID4.
         &quot;updateTime&quot;: &quot;A String&quot;, # Output only. The timestamp when the resource was last updated. Any change to the resource made by users must refresh this value. Changes to a resource made by the service should refresh this value.
       },
diff --git a/docs/dyn/servicemanagement_v1.services.consumers.html b/docs/dyn/servicemanagement_v1.services.consumers.html
index 6912488..6dfce43 100644
--- a/docs/dyn/servicemanagement_v1.services.consumers.html
+++ b/docs/dyn/servicemanagement_v1.services.consumers.html
@@ -129,7 +129,7 @@
       &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
     },
   ],
-  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member. The `bindings` in a `Policy` can refer to up to 1,500 members; up to 250 of these members can be Google groups. Each occurrence of a member counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other member, then you can add another 1,450 members to the `bindings` in the `Policy`.
     { # Associates `members` with a `role`.
       &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
         &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
@@ -172,7 +172,7 @@
         &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
       },
     ],
-    &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+    &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member. The `bindings` in a `Policy` can refer to up to 1,500 members; up to 250 of these members can be Google groups. Each occurrence of a member counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other member, then you can add another 1,450 members to the `bindings` in the `Policy`.
       { # Associates `members` with a `role`.
         &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
           &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
@@ -214,7 +214,7 @@
       &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
     },
   ],
-  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member. The `bindings` in a `Policy` can refer to up to 1,500 members; up to 250 of these members can be Google groups. Each occurrence of a member counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other member, then you can add another 1,450 members to the `bindings` in the `Policy`.
     { # Associates `members` with a `role`.
       &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
         &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
diff --git a/docs/dyn/servicemanagement_v1.services.html b/docs/dyn/servicemanagement_v1.services.html
index 3222eb9..655d3c2 100644
--- a/docs/dyn/servicemanagement_v1.services.html
+++ b/docs/dyn/servicemanagement_v1.services.html
@@ -797,7 +797,7 @@
       &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
     },
   ],
-  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member. The `bindings` in a `Policy` can refer to up to 1,500 members; up to 250 of these members can be Google groups. Each occurrence of a member counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other member, then you can add another 1,450 members to the `bindings` in the `Policy`.
     { # Associates `members` with a `role`.
       &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
         &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
@@ -882,7 +882,7 @@
         &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
       },
     ],
-    &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+    &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member. The `bindings` in a `Policy` can refer to up to 1,500 members; up to 250 of these members can be Google groups. Each occurrence of a member counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other member, then you can add another 1,450 members to the `bindings` in the `Policy`.
       { # Associates `members` with a `role`.
         &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
           &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
@@ -924,7 +924,7 @@
       &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
     },
   ],
-  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member.
+  &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one member. The `bindings` in a `Policy` can refer to up to 1,500 members; up to 250 of these members can be Google groups. Each occurrence of a member counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other member, then you can add another 1,450 members to the `bindings` in the `Policy`.
     { # Associates `members` with a `role`.
       &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: &quot;Summary size limit&quot; description: &quot;Determines if a summary is less than 100 chars&quot; expression: &quot;document.summary.size() &lt; 100&quot; Example (Equality): title: &quot;Requestor is owner&quot; description: &quot;Determines if requestor is the document owner&quot; expression: &quot;document.owner == request.auth.claims.email&quot; Example (Logic): title: &quot;Public documents&quot; description: &quot;Determine whether the document should be publicly visible&quot; expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot; Example (Data Manipulation): title: &quot;Notification string&quot; description: &quot;Create a notification string with a timestamp.&quot; expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot; The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
         &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
diff --git a/docs/dyn/slides_v1.presentations.html b/docs/dyn/slides_v1.presentations.html
index bee6c9e..1eaf511 100644
--- a/docs/dyn/slides_v1.presentations.html
+++ b/docs/dyn/slides_v1.presentations.html
@@ -777,7 +777,1014 @@
           &quot;isSkipped&quot;: True or False, # Whether the slide is skipped in the presentation mode. Defaults to false.
           &quot;layoutObjectId&quot;: &quot;A String&quot;, # The object ID of the layout that this slide is based on. This property is read-only.
           &quot;masterObjectId&quot;: &quot;A String&quot;, # The object ID of the master that this slide is based on. This property is read-only.
-          &quot;notesPage&quot;: # Object with schema name: Page # The notes page that this slide is associated with. It defines the visual appearance of a notes page when printing or exporting slides with speaker notes. A notes page inherits properties from the notes master. The placeholder shape with type BODY on the notes page contains the speaker notes for this slide. The ID of this shape is identified by the speakerNotesObjectId field. The notes page is read-only except for the text content and styles of the speaker notes shape. This property is read-only.
+          &quot;notesPage&quot;: { # A page in a presentation. # The notes page that this slide is associated with. It defines the visual appearance of a notes page when printing or exporting slides with speaker notes. A notes page inherits properties from the notes master. The placeholder shape with type BODY on the notes page contains the speaker notes for this slide. The ID of this shape is identified by the speakerNotesObjectId field. The notes page is read-only except for the text content and styles of the speaker notes shape. This property is read-only.
+            &quot;layoutProperties&quot;: { # The properties of Page are only relevant for pages with page_type LAYOUT. # Layout specific properties. Only set if page_type = LAYOUT.
+              &quot;displayName&quot;: &quot;A String&quot;, # The human-readable name of the layout.
+              &quot;masterObjectId&quot;: &quot;A String&quot;, # The object ID of the master that this layout is based on.
+              &quot;name&quot;: &quot;A String&quot;, # The name of the layout.
+            },
+            &quot;masterProperties&quot;: { # The properties of Page that are only relevant for pages with page_type MASTER. # Master specific properties. Only set if page_type = MASTER.
+              &quot;displayName&quot;: &quot;A String&quot;, # The human-readable name of the master.
+            },
+            &quot;notesProperties&quot;: { # The properties of Page that are only relevant for pages with page_type NOTES. # Notes specific properties. Only set if page_type = NOTES.
+              &quot;speakerNotesObjectId&quot;: &quot;A String&quot;, # The object ID of the shape on this notes page that contains the speaker notes for the corresponding slide. The actual shape may not always exist on the notes page. Inserting text using this object ID will automatically create the shape. In this case, the actual shape may have different object ID. The `GetPresentation` or `GetPage` action will always return the latest object ID.
+            },
+            &quot;objectId&quot;: &quot;A String&quot;, # The object ID for this page. Object IDs used by Page and PageElement share the same namespace.
+            &quot;pageElements&quot;: [ # The page elements rendered on the page.
+              { # A visual element rendered on a page.
+                &quot;description&quot;: &quot;A String&quot;, # The description of the page element. Combined with title to display alt text. The field is not supported for Group elements.
+                &quot;elementGroup&quot;: { # A PageElement kind representing a joined collection of PageElements. # A collection of page elements joined as a single unit.
+                  &quot;children&quot;: [ # The collection of elements in the group. The minimum size of a group is 2.
+                    # Object with schema name: PageElement
+                  ],
+                },
+                &quot;image&quot;: { # A PageElement kind representing an image. # An image page element.
+                  &quot;contentUrl&quot;: &quot;A String&quot;, # An URL to an image with a default lifetime of 30 minutes. This URL is tagged with the account of the requester. Anyone with the URL effectively accesses the image as the original requester. Access to the image may be lost if the presentation&#x27;s sharing settings change.
+                  &quot;imageProperties&quot;: { # The properties of the Image. # The properties of the image.
+                    &quot;brightness&quot;: 3.14, # The brightness effect of the image. The value should be in the interval [-1.0, 1.0], where 0 means no effect. This property is read-only.
+                    &quot;contrast&quot;: 3.14, # The contrast effect of the image. The value should be in the interval [-1.0, 1.0], where 0 means no effect. This property is read-only.
+                    &quot;cropProperties&quot;: { # The crop properties of an object enclosed in a container. For example, an Image. The crop properties is represented by the offsets of four edges which define a crop rectangle. The offsets are measured in percentage from the corresponding edges of the object&#x27;s original bounding rectangle towards inside, relative to the object&#x27;s original dimensions. - If the offset is in the interval (0, 1), the corresponding edge of crop rectangle is positioned inside of the object&#x27;s original bounding rectangle. - If the offset is negative or greater than 1, the corresponding edge of crop rectangle is positioned outside of the object&#x27;s original bounding rectangle. - If the left edge of the crop rectangle is on the right side of its right edge, the object will be flipped horizontally. - If the top edge of the crop rectangle is below its bottom edge, the object will be flipped vertically. - If all offsets and rotation angle is 0, the object is not cropped. After cropping, the content in the crop rectangle will be stretched to fit its container. # The crop properties of the image. If not set, the image is not cropped. This property is read-only.
+                      &quot;angle&quot;: 3.14, # The rotation angle of the crop window around its center, in radians. Rotation angle is applied after the offset.
+                      &quot;bottomOffset&quot;: 3.14, # The offset specifies the bottom edge of the crop rectangle that is located above the original bounding rectangle bottom edge, relative to the object&#x27;s original height.
+                      &quot;leftOffset&quot;: 3.14, # The offset specifies the left edge of the crop rectangle that is located to the right of the original bounding rectangle left edge, relative to the object&#x27;s original width.
+                      &quot;rightOffset&quot;: 3.14, # The offset specifies the right edge of the crop rectangle that is located to the left of the original bounding rectangle right edge, relative to the object&#x27;s original width.
+                      &quot;topOffset&quot;: 3.14, # The offset specifies the top edge of the crop rectangle that is located below the original bounding rectangle top edge, relative to the object&#x27;s original height.
+                    },
+                    &quot;link&quot;: { # A hypertext link. # The hyperlink destination of the image. If unset, there is no link.
+                      &quot;pageObjectId&quot;: &quot;A String&quot;, # If set, indicates this is a link to the specific page in this presentation with this ID. A page with this ID may not exist.
+                      &quot;relativeLink&quot;: &quot;A String&quot;, # If set, indicates this is a link to a slide in this presentation, addressed by its position.
+                      &quot;slideIndex&quot;: 42, # If set, indicates this is a link to the slide at this zero-based index in the presentation. There may not be a slide at this index.
+                      &quot;url&quot;: &quot;A String&quot;, # If set, indicates this is a link to the external web page at this URL.
+                    },
+                    &quot;outline&quot;: { # The outline of a PageElement. If these fields are unset, they may be inherited from a parent placeholder if it exists. If there is no parent, the fields will default to the value used for new page elements created in the Slides editor, which may depend on the page element kind. # The outline of the image. If not set, the image has no outline.
+                      &quot;dashStyle&quot;: &quot;A String&quot;, # The dash style of the outline.
+                      &quot;outlineFill&quot;: { # The fill of the outline. # The fill of the outline.
+                        &quot;solidFill&quot;: { # A solid color fill. The page or page element is filled entirely with the specified color value. If any field is unset, its value may be inherited from a parent placeholder if it exists. # Solid color fill.
+                          &quot;alpha&quot;: 3.14, # The fraction of this `color` that should be applied to the pixel. That is, the final pixel color is defined by the equation: pixel color = alpha * (color) + (1.0 - alpha) * (background color) This means that a value of 1.0 corresponds to a solid color, whereas a value of 0.0 corresponds to a completely transparent color.
+                          &quot;color&quot;: { # A themeable solid color value. # The color value of the solid fill.
+                            &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                              &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                              &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                              &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                            },
+                            &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                          },
+                        },
+                      },
+                      &quot;propertyState&quot;: &quot;A String&quot;, # The outline property state. Updating the outline on a page element will implicitly update this field to `RENDERED`, unless another value is specified in the same request. To have no outline on a page element, set this field to `NOT_RENDERED`. In this case, any other outline fields set in the same request will be ignored.
+                      &quot;weight&quot;: { # A magnitude in a single direction in the specified units. # The thickness of the outline.
+                        &quot;magnitude&quot;: 3.14, # The magnitude.
+                        &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                      },
+                    },
+                    &quot;recolor&quot;: { # A recolor effect applied on an image. # The recolor effect of the image. If not set, the image is not recolored. This property is read-only.
+                      &quot;name&quot;: &quot;A String&quot;, # The name of the recolor effect. The name is determined from the `recolor_stops` by matching the gradient against the colors in the page&#x27;s current color scheme. This property is read-only.
+                      &quot;recolorStops&quot;: [ # The recolor effect is represented by a gradient, which is a list of color stops. The colors in the gradient will replace the corresponding colors at the same position in the color palette and apply to the image. This property is read-only.
+                        { # A color and position in a gradient band.
+                          &quot;alpha&quot;: 3.14, # The alpha value of this color in the gradient band. Defaults to 1.0, fully opaque.
+                          &quot;color&quot;: { # A themeable solid color value. # The color of the gradient stop.
+                            &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                              &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                              &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                              &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                            },
+                            &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                          },
+                          &quot;position&quot;: 3.14, # The relative position of the color stop in the gradient band measured in percentage. The value should be in the interval [0.0, 1.0].
+                        },
+                      ],
+                    },
+                    &quot;shadow&quot;: { # The shadow properties of a page element. If these fields are unset, they may be inherited from a parent placeholder if it exists. If there is no parent, the fields will default to the value used for new page elements created in the Slides editor, which may depend on the page element kind. # The shadow of the image. If not set, the image has no shadow. This property is read-only.
+                      &quot;alignment&quot;: &quot;A String&quot;, # The alignment point of the shadow, that sets the origin for translate, scale and skew of the shadow. This property is read-only.
+                      &quot;alpha&quot;: 3.14, # The alpha of the shadow&#x27;s color, from 0.0 to 1.0.
+                      &quot;blurRadius&quot;: { # A magnitude in a single direction in the specified units. # The radius of the shadow blur. The larger the radius, the more diffuse the shadow becomes.
+                        &quot;magnitude&quot;: 3.14, # The magnitude.
+                        &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                      },
+                      &quot;color&quot;: { # A themeable solid color value. # The shadow color value.
+                        &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                          &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                          &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                          &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                        },
+                        &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                      },
+                      &quot;propertyState&quot;: &quot;A String&quot;, # The shadow property state. Updating the shadow on a page element will implicitly update this field to `RENDERED`, unless another value is specified in the same request. To have no shadow on a page element, set this field to `NOT_RENDERED`. In this case, any other shadow fields set in the same request will be ignored.
+                      &quot;rotateWithShape&quot;: True or False, # Whether the shadow should rotate with the shape. This property is read-only.
+                      &quot;transform&quot;: { # AffineTransform uses a 3x3 matrix with an implied last row of [ 0 0 1 ] to transform source coordinates (x,y) into destination coordinates (x&#x27;, y&#x27;) according to: x&#x27; x = shear_y scale_y translate_y 1 [ 1 ] After transformation, x&#x27; = scale_x * x + shear_x * y + translate_x; y&#x27; = scale_y * y + shear_y * x + translate_y; This message is therefore composed of these six matrix elements. # Transform that encodes the translate, scale, and skew of the shadow, relative to the alignment position.
+                        &quot;scaleX&quot;: 3.14, # The X coordinate scaling element.
+                        &quot;scaleY&quot;: 3.14, # The Y coordinate scaling element.
+                        &quot;shearX&quot;: 3.14, # The X coordinate shearing element.
+                        &quot;shearY&quot;: 3.14, # The Y coordinate shearing element.
+                        &quot;translateX&quot;: 3.14, # The X coordinate translation element.
+                        &quot;translateY&quot;: 3.14, # The Y coordinate translation element.
+                        &quot;unit&quot;: &quot;A String&quot;, # The units for translate elements.
+                      },
+                      &quot;type&quot;: &quot;A String&quot;, # The type of the shadow. This property is read-only.
+                    },
+                    &quot;transparency&quot;: 3.14, # The transparency effect of the image. The value should be in the interval [0.0, 1.0], where 0 means no effect and 1 means completely transparent. This property is read-only.
+                  },
+                  &quot;placeholder&quot;: { # The placeholder information that uniquely identifies a placeholder shape. # Placeholders are page elements that inherit from corresponding placeholders on layouts and masters. If set, the image is a placeholder image and any inherited properties can be resolved by looking at the parent placeholder identified by the Placeholder.parent_object_id field.
+                    &quot;index&quot;: 42, # The index of the placeholder. If the same placeholder types are present in the same page, they would have different index values.
+                    &quot;parentObjectId&quot;: &quot;A String&quot;, # The object ID of this shape&#x27;s parent placeholder. If unset, the parent placeholder shape does not exist, so the shape does not inherit properties from any other shape.
+                    &quot;type&quot;: &quot;A String&quot;, # The type of the placeholder.
+                  },
+                  &quot;sourceUrl&quot;: &quot;A String&quot;, # The source URL is the URL used to insert the image. The source URL can be empty.
+                },
+                &quot;line&quot;: { # A PageElement kind representing a non-connector line, straight connector, curved connector, or bent connector. # A line page element.
+                  &quot;lineCategory&quot;: &quot;A String&quot;, # The category of the line. It matches the `category` specified in CreateLineRequest, and can be updated with UpdateLineCategoryRequest.
+                  &quot;lineProperties&quot;: { # The properties of the Line. When unset, these fields default to values that match the appearance of new lines created in the Slides editor. # The properties of the line.
+                    &quot;dashStyle&quot;: &quot;A String&quot;, # The dash style of the line.
+                    &quot;endArrow&quot;: &quot;A String&quot;, # The style of the arrow at the end of the line.
+                    &quot;endConnection&quot;: { # The properties for one end of a Line connection. # The connection at the end of the line. If unset, there is no connection. Only lines with a Type indicating it is a &quot;connector&quot; can have an `end_connection`.
+                      &quot;connectedObjectId&quot;: &quot;A String&quot;, # The object ID of the connected page element. Some page elements, such as groups, tables, and lines do not have connection sites and therefore cannot be connected to a connector line.
+                      &quot;connectionSiteIndex&quot;: 42, # The index of the connection site on the connected page element. In most cases, it corresponds to the predefined connection site index from the ECMA-376 standard. More information on those connection sites can be found in the description of the &quot;cnx&quot; attribute in section 20.1.9.9 and Annex H. &quot;Predefined DrawingML Shape and Text Geometries&quot; of &quot;Office Open XML File Formats-Fundamentals and Markup Language Reference&quot;, part 1 of [ECMA-376 5th edition] (http://www.ecma-international.org/publications/standards/Ecma-376.htm). The position of each connection site can also be viewed from Slides editor.
+                    },
+                    &quot;lineFill&quot;: { # The fill of the line. # The fill of the line. The default line fill matches the defaults for new lines created in the Slides editor.
+                      &quot;solidFill&quot;: { # A solid color fill. The page or page element is filled entirely with the specified color value. If any field is unset, its value may be inherited from a parent placeholder if it exists. # Solid color fill.
+                        &quot;alpha&quot;: 3.14, # The fraction of this `color` that should be applied to the pixel. That is, the final pixel color is defined by the equation: pixel color = alpha * (color) + (1.0 - alpha) * (background color) This means that a value of 1.0 corresponds to a solid color, whereas a value of 0.0 corresponds to a completely transparent color.
+                        &quot;color&quot;: { # A themeable solid color value. # The color value of the solid fill.
+                          &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                            &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                            &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                            &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                          },
+                          &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                        },
+                      },
+                    },
+                    &quot;link&quot;: { # A hypertext link. # The hyperlink destination of the line. If unset, there is no link.
+                      &quot;pageObjectId&quot;: &quot;A String&quot;, # If set, indicates this is a link to the specific page in this presentation with this ID. A page with this ID may not exist.
+                      &quot;relativeLink&quot;: &quot;A String&quot;, # If set, indicates this is a link to a slide in this presentation, addressed by its position.
+                      &quot;slideIndex&quot;: 42, # If set, indicates this is a link to the slide at this zero-based index in the presentation. There may not be a slide at this index.
+                      &quot;url&quot;: &quot;A String&quot;, # If set, indicates this is a link to the external web page at this URL.
+                    },
+                    &quot;startArrow&quot;: &quot;A String&quot;, # The style of the arrow at the beginning of the line.
+                    &quot;startConnection&quot;: { # The properties for one end of a Line connection. # The connection at the beginning of the line. If unset, there is no connection. Only lines with a Type indicating it is a &quot;connector&quot; can have a `start_connection`.
+                      &quot;connectedObjectId&quot;: &quot;A String&quot;, # The object ID of the connected page element. Some page elements, such as groups, tables, and lines do not have connection sites and therefore cannot be connected to a connector line.
+                      &quot;connectionSiteIndex&quot;: 42, # The index of the connection site on the connected page element. In most cases, it corresponds to the predefined connection site index from the ECMA-376 standard. More information on those connection sites can be found in the description of the &quot;cnx&quot; attribute in section 20.1.9.9 and Annex H. &quot;Predefined DrawingML Shape and Text Geometries&quot; of &quot;Office Open XML File Formats-Fundamentals and Markup Language Reference&quot;, part 1 of [ECMA-376 5th edition] (http://www.ecma-international.org/publications/standards/Ecma-376.htm). The position of each connection site can also be viewed from Slides editor.
+                    },
+                    &quot;weight&quot;: { # A magnitude in a single direction in the specified units. # The thickness of the line.
+                      &quot;magnitude&quot;: 3.14, # The magnitude.
+                      &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                    },
+                  },
+                  &quot;lineType&quot;: &quot;A String&quot;, # The type of the line.
+                },
+                &quot;objectId&quot;: &quot;A String&quot;, # The object ID for this page element. Object IDs used by google.apps.slides.v1.Page and google.apps.slides.v1.PageElement share the same namespace.
+                &quot;shape&quot;: { # A PageElement kind representing a generic shape that does not have a more specific classification. # A generic shape.
+                  &quot;placeholder&quot;: { # The placeholder information that uniquely identifies a placeholder shape. # Placeholders are page elements that inherit from corresponding placeholders on layouts and masters. If set, the shape is a placeholder shape and any inherited properties can be resolved by looking at the parent placeholder identified by the Placeholder.parent_object_id field.
+                    &quot;index&quot;: 42, # The index of the placeholder. If the same placeholder types are present in the same page, they would have different index values.
+                    &quot;parentObjectId&quot;: &quot;A String&quot;, # The object ID of this shape&#x27;s parent placeholder. If unset, the parent placeholder shape does not exist, so the shape does not inherit properties from any other shape.
+                    &quot;type&quot;: &quot;A String&quot;, # The type of the placeholder.
+                  },
+                  &quot;shapeProperties&quot;: { # The properties of a Shape. If the shape is a placeholder shape as determined by the placeholder field, then these properties may be inherited from a parent placeholder shape. Determining the rendered value of the property depends on the corresponding property_state field value. Any text autofit settings on the shape are automatically deactivated by requests that can impact how text fits in the shape. # The properties of the shape.
+                    &quot;autofit&quot;: { # The autofit properties of a Shape. # The autofit properties of the shape. This property is only set for shapes that allow text.
+                      &quot;autofitType&quot;: &quot;A String&quot;, # The autofit type of the shape. If the autofit type is AUTOFIT_TYPE_UNSPECIFIED, the autofit type is inherited from a parent placeholder if it exists. The field is automatically set to NONE if a request is made that might affect text fitting within its bounding text box. In this case the font_scale is applied to the font_size and the line_spacing_reduction is applied to the line_spacing. Both properties are also reset to default values.
+                      &quot;fontScale&quot;: 3.14, # The font scale applied to the shape. For shapes with autofit_type NONE or SHAPE_AUTOFIT, this value is the default value of 1. For TEXT_AUTOFIT, this value multiplied by the font_size gives the font size that is rendered in the editor. This property is read-only.
+                      &quot;lineSpacingReduction&quot;: 3.14, # The line spacing reduction applied to the shape. For shapes with autofit_type NONE or SHAPE_AUTOFIT, this value is the default value of 0. For TEXT_AUTOFIT, this value subtracted from the line_spacing gives the line spacing that is rendered in the editor. This property is read-only.
+                    },
+                    &quot;contentAlignment&quot;: &quot;A String&quot;, # The alignment of the content in the shape. If unspecified, the alignment is inherited from a parent placeholder if it exists. If the shape has no parent, the default alignment matches the alignment for new shapes created in the Slides editor.
+                    &quot;link&quot;: { # A hypertext link. # The hyperlink destination of the shape. If unset, there is no link. Links are not inherited from parent placeholders.
+                      &quot;pageObjectId&quot;: &quot;A String&quot;, # If set, indicates this is a link to the specific page in this presentation with this ID. A page with this ID may not exist.
+                      &quot;relativeLink&quot;: &quot;A String&quot;, # If set, indicates this is a link to a slide in this presentation, addressed by its position.
+                      &quot;slideIndex&quot;: 42, # If set, indicates this is a link to the slide at this zero-based index in the presentation. There may not be a slide at this index.
+                      &quot;url&quot;: &quot;A String&quot;, # If set, indicates this is a link to the external web page at this URL.
+                    },
+                    &quot;outline&quot;: { # The outline of a PageElement. If these fields are unset, they may be inherited from a parent placeholder if it exists. If there is no parent, the fields will default to the value used for new page elements created in the Slides editor, which may depend on the page element kind. # The outline of the shape. If unset, the outline is inherited from a parent placeholder if it exists. If the shape has no parent, then the default outline depends on the shape type, matching the defaults for new shapes created in the Slides editor.
+                      &quot;dashStyle&quot;: &quot;A String&quot;, # The dash style of the outline.
+                      &quot;outlineFill&quot;: { # The fill of the outline. # The fill of the outline.
+                        &quot;solidFill&quot;: { # A solid color fill. The page or page element is filled entirely with the specified color value. If any field is unset, its value may be inherited from a parent placeholder if it exists. # Solid color fill.
+                          &quot;alpha&quot;: 3.14, # The fraction of this `color` that should be applied to the pixel. That is, the final pixel color is defined by the equation: pixel color = alpha * (color) + (1.0 - alpha) * (background color) This means that a value of 1.0 corresponds to a solid color, whereas a value of 0.0 corresponds to a completely transparent color.
+                          &quot;color&quot;: { # A themeable solid color value. # The color value of the solid fill.
+                            &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                              &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                              &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                              &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                            },
+                            &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                          },
+                        },
+                      },
+                      &quot;propertyState&quot;: &quot;A String&quot;, # The outline property state. Updating the outline on a page element will implicitly update this field to `RENDERED`, unless another value is specified in the same request. To have no outline on a page element, set this field to `NOT_RENDERED`. In this case, any other outline fields set in the same request will be ignored.
+                      &quot;weight&quot;: { # A magnitude in a single direction in the specified units. # The thickness of the outline.
+                        &quot;magnitude&quot;: 3.14, # The magnitude.
+                        &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                      },
+                    },
+                    &quot;shadow&quot;: { # The shadow properties of a page element. If these fields are unset, they may be inherited from a parent placeholder if it exists. If there is no parent, the fields will default to the value used for new page elements created in the Slides editor, which may depend on the page element kind. # The shadow properties of the shape. If unset, the shadow is inherited from a parent placeholder if it exists. If the shape has no parent, then the default shadow matches the defaults for new shapes created in the Slides editor. This property is read-only.
+                      &quot;alignment&quot;: &quot;A String&quot;, # The alignment point of the shadow, that sets the origin for translate, scale and skew of the shadow. This property is read-only.
+                      &quot;alpha&quot;: 3.14, # The alpha of the shadow&#x27;s color, from 0.0 to 1.0.
+                      &quot;blurRadius&quot;: { # A magnitude in a single direction in the specified units. # The radius of the shadow blur. The larger the radius, the more diffuse the shadow becomes.
+                        &quot;magnitude&quot;: 3.14, # The magnitude.
+                        &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                      },
+                      &quot;color&quot;: { # A themeable solid color value. # The shadow color value.
+                        &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                          &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                          &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                          &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                        },
+                        &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                      },
+                      &quot;propertyState&quot;: &quot;A String&quot;, # The shadow property state. Updating the shadow on a page element will implicitly update this field to `RENDERED`, unless another value is specified in the same request. To have no shadow on a page element, set this field to `NOT_RENDERED`. In this case, any other shadow fields set in the same request will be ignored.
+                      &quot;rotateWithShape&quot;: True or False, # Whether the shadow should rotate with the shape. This property is read-only.
+                      &quot;transform&quot;: { # AffineTransform uses a 3x3 matrix with an implied last row of [ 0 0 1 ] to transform source coordinates (x,y) into destination coordinates (x&#x27;, y&#x27;) according to: x&#x27; x = shear_y scale_y translate_y 1 [ 1 ] After transformation, x&#x27; = scale_x * x + shear_x * y + translate_x; y&#x27; = scale_y * y + shear_y * x + translate_y; This message is therefore composed of these six matrix elements. # Transform that encodes the translate, scale, and skew of the shadow, relative to the alignment position.
+                        &quot;scaleX&quot;: 3.14, # The X coordinate scaling element.
+                        &quot;scaleY&quot;: 3.14, # The Y coordinate scaling element.
+                        &quot;shearX&quot;: 3.14, # The X coordinate shearing element.
+                        &quot;shearY&quot;: 3.14, # The Y coordinate shearing element.
+                        &quot;translateX&quot;: 3.14, # The X coordinate translation element.
+                        &quot;translateY&quot;: 3.14, # The Y coordinate translation element.
+                        &quot;unit&quot;: &quot;A String&quot;, # The units for translate elements.
+                      },
+                      &quot;type&quot;: &quot;A String&quot;, # The type of the shadow. This property is read-only.
+                    },
+                    &quot;shapeBackgroundFill&quot;: { # The shape background fill. # The background fill of the shape. If unset, the background fill is inherited from a parent placeholder if it exists. If the shape has no parent, then the default background fill depends on the shape type, matching the defaults for new shapes created in the Slides editor.
+                      &quot;propertyState&quot;: &quot;A String&quot;, # The background fill property state. Updating the fill on a shape will implicitly update this field to `RENDERED`, unless another value is specified in the same request. To have no fill on a shape, set this field to `NOT_RENDERED`. In this case, any other fill fields set in the same request will be ignored.
+                      &quot;solidFill&quot;: { # A solid color fill. The page or page element is filled entirely with the specified color value. If any field is unset, its value may be inherited from a parent placeholder if it exists. # Solid color fill.
+                        &quot;alpha&quot;: 3.14, # The fraction of this `color` that should be applied to the pixel. That is, the final pixel color is defined by the equation: pixel color = alpha * (color) + (1.0 - alpha) * (background color) This means that a value of 1.0 corresponds to a solid color, whereas a value of 0.0 corresponds to a completely transparent color.
+                        &quot;color&quot;: { # A themeable solid color value. # The color value of the solid fill.
+                          &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                            &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                            &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                            &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                          },
+                          &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                        },
+                      },
+                    },
+                  },
+                  &quot;shapeType&quot;: &quot;A String&quot;, # The type of the shape.
+                  &quot;text&quot;: { # The general text content. The text must reside in a compatible shape (e.g. text box or rectangle) or a table cell in a page. # The text content of the shape.
+                    &quot;lists&quot;: { # The bulleted lists contained in this text, keyed by list ID.
+                      &quot;a_key&quot;: { # A List describes the look and feel of bullets belonging to paragraphs associated with a list. A paragraph that is part of a list has an implicit reference to that list&#x27;s ID.
+                        &quot;listId&quot;: &quot;A String&quot;, # The ID of the list.
+                        &quot;nestingLevel&quot;: { # A map of nesting levels to the properties of bullets at the associated level. A list has at most nine levels of nesting, so the possible values for the keys of this map are 0 through 8, inclusive.
+                          &quot;a_key&quot;: { # Contains properties describing the look and feel of a list bullet at a given level of nesting.
+                            &quot;bulletStyle&quot;: { # Represents the styling that can be applied to a TextRun. If this text is contained in a shape with a parent placeholder, then these text styles may be inherited from the parent. Which text styles are inherited depend on the nesting level of lists: * A text run in a paragraph that is not in a list will inherit its text style from the the newline character in the paragraph at the 0 nesting level of the list inside the parent placeholder. * A text run in a paragraph that is in a list will inherit its text style from the newline character in the paragraph at its corresponding nesting level of the list inside the parent placeholder. Inherited text styles are represented as unset fields in this message. If text is contained in a shape without a parent placeholder, unsetting these fields will revert the style to a value matching the defaults in the Slides editor. # The style of a bullet at this level of nesting.
+                              &quot;backgroundColor&quot;: { # A color that can either be fully opaque or fully transparent. # The background color of the text. If set, the color is either opaque or transparent, depending on if the `opaque_color` field in it is set.
+                                &quot;opaqueColor&quot;: { # A themeable solid color value. # If set, this will be used as an opaque color. If unset, this represents a transparent color.
+                                  &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                                    &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                                    &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                                    &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                                  },
+                                  &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                                },
+                              },
+                              &quot;baselineOffset&quot;: &quot;A String&quot;, # The text&#x27;s vertical offset from its normal position. Text with `SUPERSCRIPT` or `SUBSCRIPT` baseline offsets is automatically rendered in a smaller font size, computed based on the `font_size` field. The `font_size` itself is not affected by changes in this field.
+                              &quot;bold&quot;: True or False, # Whether or not the text is rendered as bold.
+                              &quot;fontFamily&quot;: &quot;A String&quot;, # The font family of the text. The font family can be any font from the Font menu in Slides or from [Google Fonts] (https://fonts.google.com/). If the font name is unrecognized, the text is rendered in `Arial`. Some fonts can affect the weight of the text. If an update request specifies values for both `font_family` and `bold`, the explicitly-set `bold` value is used.
+                              &quot;fontSize&quot;: { # A magnitude in a single direction in the specified units. # The size of the text&#x27;s font. When read, the `font_size` will specified in points.
+                                &quot;magnitude&quot;: 3.14, # The magnitude.
+                                &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                              },
+                              &quot;foregroundColor&quot;: { # A color that can either be fully opaque or fully transparent. # The color of the text itself. If set, the color is either opaque or transparent, depending on if the `opaque_color` field in it is set.
+                                &quot;opaqueColor&quot;: { # A themeable solid color value. # If set, this will be used as an opaque color. If unset, this represents a transparent color.
+                                  &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                                    &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                                    &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                                    &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                                  },
+                                  &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                                },
+                              },
+                              &quot;italic&quot;: True or False, # Whether or not the text is italicized.
+                              &quot;link&quot;: { # A hypertext link. # The hyperlink destination of the text. If unset, there is no link. Links are not inherited from parent text. Changing the link in an update request causes some other changes to the text style of the range: * When setting a link, the text foreground color will be set to ThemeColorType.HYPERLINK and the text will be underlined. If these fields are modified in the same request, those values will be used instead of the link defaults. * Setting a link on a text range that overlaps with an existing link will also update the existing link to point to the new URL. * Links are not settable on newline characters. As a result, setting a link on a text range that crosses a paragraph boundary, such as `&quot;ABC\n123&quot;`, will separate the newline character(s) into their own text runs. The link will be applied separately to the runs before and after the newline. * Removing a link will update the text style of the range to match the style of the preceding text (or the default text styles if the preceding text is another link) unless different styles are being set in the same request.
+                                &quot;pageObjectId&quot;: &quot;A String&quot;, # If set, indicates this is a link to the specific page in this presentation with this ID. A page with this ID may not exist.
+                                &quot;relativeLink&quot;: &quot;A String&quot;, # If set, indicates this is a link to a slide in this presentation, addressed by its position.
+                                &quot;slideIndex&quot;: 42, # If set, indicates this is a link to the slide at this zero-based index in the presentation. There may not be a slide at this index.
+                                &quot;url&quot;: &quot;A String&quot;, # If set, indicates this is a link to the external web page at this URL.
+                              },
+                              &quot;smallCaps&quot;: True or False, # Whether or not the text is in small capital letters.
+                              &quot;strikethrough&quot;: True or False, # Whether or not the text is struck through.
+                              &quot;underline&quot;: True or False, # Whether or not the text is underlined.
+                              &quot;weightedFontFamily&quot;: { # Represents a font family and weight used to style a TextRun. # The font family and rendered weight of the text. This field is an extension of `font_family` meant to support explicit font weights without breaking backwards compatibility. As such, when reading the style of a range of text, the value of `weighted_font_family#font_family` will always be equal to that of `font_family`. However, when writing, if both fields are included in the field mask (either explicitly or through the wildcard `&quot;*&quot;`), their values are reconciled as follows: * If `font_family` is set and `weighted_font_family` is not, the value of `font_family` is applied with weight `400` (&quot;normal&quot;). * If both fields are set, the value of `font_family` must match that of `weighted_font_family#font_family`. If so, the font family and weight of `weighted_font_family` is applied. Otherwise, a 400 bad request error is returned. * If `weighted_font_family` is set and `font_family` is not, the font family and weight of `weighted_font_family` is applied. * If neither field is set, the font family and weight of the text inherit from the parent. Note that these properties cannot inherit separately from each other. If an update request specifies values for both `weighted_font_family` and `bold`, the `weighted_font_family` is applied first, then `bold`. If `weighted_font_family#weight` is not set, it defaults to `400`. If `weighted_font_family` is set, then `weighted_font_family#font_family` must also be set with a non-empty value. Otherwise, a 400 bad request error is returned.
+                                &quot;fontFamily&quot;: &quot;A String&quot;, # The font family of the text. The font family can be any font from the Font menu in Slides or from [Google Fonts] (https://fonts.google.com/). If the font name is unrecognized, the text is rendered in `Arial`.
+                                &quot;weight&quot;: 42, # The rendered weight of the text. This field can have any value that is a multiple of `100` between `100` and `900`, inclusive. This range corresponds to the numerical values described in the CSS 2.1 Specification, [section 15.6](https://www.w3.org/TR/CSS21/fonts.html#font-boldness), with non-numerical values disallowed. Weights greater than or equal to `700` are considered bold, and weights less than `700`are not bold. The default value is `400` (&quot;normal&quot;).
+                              },
+                            },
+                          },
+                        },
+                      },
+                    },
+                    &quot;textElements&quot;: [ # The text contents broken down into its component parts, including styling information. This property is read-only.
+                      { # A TextElement describes the content of a range of indices in the text content of a Shape or TableCell.
+                        &quot;autoText&quot;: { # A TextElement kind that represents auto text. # A TextElement representing a spot in the text that is dynamically replaced with content that can change over time.
+                          &quot;content&quot;: &quot;A String&quot;, # The rendered content of this auto text, if available.
+                          &quot;style&quot;: { # Represents the styling that can be applied to a TextRun. If this text is contained in a shape with a parent placeholder, then these text styles may be inherited from the parent. Which text styles are inherited depend on the nesting level of lists: * A text run in a paragraph that is not in a list will inherit its text style from the the newline character in the paragraph at the 0 nesting level of the list inside the parent placeholder. * A text run in a paragraph that is in a list will inherit its text style from the newline character in the paragraph at its corresponding nesting level of the list inside the parent placeholder. Inherited text styles are represented as unset fields in this message. If text is contained in a shape without a parent placeholder, unsetting these fields will revert the style to a value matching the defaults in the Slides editor. # The styling applied to this auto text.
+                            &quot;backgroundColor&quot;: { # A color that can either be fully opaque or fully transparent. # The background color of the text. If set, the color is either opaque or transparent, depending on if the `opaque_color` field in it is set.
+                              &quot;opaqueColor&quot;: { # A themeable solid color value. # If set, this will be used as an opaque color. If unset, this represents a transparent color.
+                                &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                                  &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                                  &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                                  &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                                },
+                                &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                              },
+                            },
+                            &quot;baselineOffset&quot;: &quot;A String&quot;, # The text&#x27;s vertical offset from its normal position. Text with `SUPERSCRIPT` or `SUBSCRIPT` baseline offsets is automatically rendered in a smaller font size, computed based on the `font_size` field. The `font_size` itself is not affected by changes in this field.
+                            &quot;bold&quot;: True or False, # Whether or not the text is rendered as bold.
+                            &quot;fontFamily&quot;: &quot;A String&quot;, # The font family of the text. The font family can be any font from the Font menu in Slides or from [Google Fonts] (https://fonts.google.com/). If the font name is unrecognized, the text is rendered in `Arial`. Some fonts can affect the weight of the text. If an update request specifies values for both `font_family` and `bold`, the explicitly-set `bold` value is used.
+                            &quot;fontSize&quot;: { # A magnitude in a single direction in the specified units. # The size of the text&#x27;s font. When read, the `font_size` will specified in points.
+                              &quot;magnitude&quot;: 3.14, # The magnitude.
+                              &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                            },
+                            &quot;foregroundColor&quot;: { # A color that can either be fully opaque or fully transparent. # The color of the text itself. If set, the color is either opaque or transparent, depending on if the `opaque_color` field in it is set.
+                              &quot;opaqueColor&quot;: { # A themeable solid color value. # If set, this will be used as an opaque color. If unset, this represents a transparent color.
+                                &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                                  &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                                  &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                                  &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                                },
+                                &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                              },
+                            },
+                            &quot;italic&quot;: True or False, # Whether or not the text is italicized.
+                            &quot;link&quot;: { # A hypertext link. # The hyperlink destination of the text. If unset, there is no link. Links are not inherited from parent text. Changing the link in an update request causes some other changes to the text style of the range: * When setting a link, the text foreground color will be set to ThemeColorType.HYPERLINK and the text will be underlined. If these fields are modified in the same request, those values will be used instead of the link defaults. * Setting a link on a text range that overlaps with an existing link will also update the existing link to point to the new URL. * Links are not settable on newline characters. As a result, setting a link on a text range that crosses a paragraph boundary, such as `&quot;ABC\n123&quot;`, will separate the newline character(s) into their own text runs. The link will be applied separately to the runs before and after the newline. * Removing a link will update the text style of the range to match the style of the preceding text (or the default text styles if the preceding text is another link) unless different styles are being set in the same request.
+                              &quot;pageObjectId&quot;: &quot;A String&quot;, # If set, indicates this is a link to the specific page in this presentation with this ID. A page with this ID may not exist.
+                              &quot;relativeLink&quot;: &quot;A String&quot;, # If set, indicates this is a link to a slide in this presentation, addressed by its position.
+                              &quot;slideIndex&quot;: 42, # If set, indicates this is a link to the slide at this zero-based index in the presentation. There may not be a slide at this index.
+                              &quot;url&quot;: &quot;A String&quot;, # If set, indicates this is a link to the external web page at this URL.
+                            },
+                            &quot;smallCaps&quot;: True or False, # Whether or not the text is in small capital letters.
+                            &quot;strikethrough&quot;: True or False, # Whether or not the text is struck through.
+                            &quot;underline&quot;: True or False, # Whether or not the text is underlined.
+                            &quot;weightedFontFamily&quot;: { # Represents a font family and weight used to style a TextRun. # The font family and rendered weight of the text. This field is an extension of `font_family` meant to support explicit font weights without breaking backwards compatibility. As such, when reading the style of a range of text, the value of `weighted_font_family#font_family` will always be equal to that of `font_family`. However, when writing, if both fields are included in the field mask (either explicitly or through the wildcard `&quot;*&quot;`), their values are reconciled as follows: * If `font_family` is set and `weighted_font_family` is not, the value of `font_family` is applied with weight `400` (&quot;normal&quot;). * If both fields are set, the value of `font_family` must match that of `weighted_font_family#font_family`. If so, the font family and weight of `weighted_font_family` is applied. Otherwise, a 400 bad request error is returned. * If `weighted_font_family` is set and `font_family` is not, the font family and weight of `weighted_font_family` is applied. * If neither field is set, the font family and weight of the text inherit from the parent. Note that these properties cannot inherit separately from each other. If an update request specifies values for both `weighted_font_family` and `bold`, the `weighted_font_family` is applied first, then `bold`. If `weighted_font_family#weight` is not set, it defaults to `400`. If `weighted_font_family` is set, then `weighted_font_family#font_family` must also be set with a non-empty value. Otherwise, a 400 bad request error is returned.
+                              &quot;fontFamily&quot;: &quot;A String&quot;, # The font family of the text. The font family can be any font from the Font menu in Slides or from [Google Fonts] (https://fonts.google.com/). If the font name is unrecognized, the text is rendered in `Arial`.
+                              &quot;weight&quot;: 42, # The rendered weight of the text. This field can have any value that is a multiple of `100` between `100` and `900`, inclusive. This range corresponds to the numerical values described in the CSS 2.1 Specification, [section 15.6](https://www.w3.org/TR/CSS21/fonts.html#font-boldness), with non-numerical values disallowed. Weights greater than or equal to `700` are considered bold, and weights less than `700`are not bold. The default value is `400` (&quot;normal&quot;).
+                            },
+                          },
+                          &quot;type&quot;: &quot;A String&quot;, # The type of this auto text.
+                        },
+                        &quot;endIndex&quot;: 42, # The zero-based end index of this text element, exclusive, in Unicode code units.
+                        &quot;paragraphMarker&quot;: { # A TextElement kind that represents the beginning of a new paragraph. # A marker representing the beginning of a new paragraph. The `start_index` and `end_index` of this TextElement represent the range of the paragraph. Other TextElements with an index range contained inside this paragraph&#x27;s range are considered to be part of this paragraph. The range of indices of two separate paragraphs will never overlap.
+                          &quot;bullet&quot;: { # Describes the bullet of a paragraph. # The bullet for this paragraph. If not present, the paragraph does not belong to a list.
+                            &quot;bulletStyle&quot;: { # Represents the styling that can be applied to a TextRun. If this text is contained in a shape with a parent placeholder, then these text styles may be inherited from the parent. Which text styles are inherited depend on the nesting level of lists: * A text run in a paragraph that is not in a list will inherit its text style from the the newline character in the paragraph at the 0 nesting level of the list inside the parent placeholder. * A text run in a paragraph that is in a list will inherit its text style from the newline character in the paragraph at its corresponding nesting level of the list inside the parent placeholder. Inherited text styles are represented as unset fields in this message. If text is contained in a shape without a parent placeholder, unsetting these fields will revert the style to a value matching the defaults in the Slides editor. # The paragraph specific text style applied to this bullet.
+                              &quot;backgroundColor&quot;: { # A color that can either be fully opaque or fully transparent. # The background color of the text. If set, the color is either opaque or transparent, depending on if the `opaque_color` field in it is set.
+                                &quot;opaqueColor&quot;: { # A themeable solid color value. # If set, this will be used as an opaque color. If unset, this represents a transparent color.
+                                  &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                                    &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                                    &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                                    &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                                  },
+                                  &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                                },
+                              },
+                              &quot;baselineOffset&quot;: &quot;A String&quot;, # The text&#x27;s vertical offset from its normal position. Text with `SUPERSCRIPT` or `SUBSCRIPT` baseline offsets is automatically rendered in a smaller font size, computed based on the `font_size` field. The `font_size` itself is not affected by changes in this field.
+                              &quot;bold&quot;: True or False, # Whether or not the text is rendered as bold.
+                              &quot;fontFamily&quot;: &quot;A String&quot;, # The font family of the text. The font family can be any font from the Font menu in Slides or from [Google Fonts] (https://fonts.google.com/). If the font name is unrecognized, the text is rendered in `Arial`. Some fonts can affect the weight of the text. If an update request specifies values for both `font_family` and `bold`, the explicitly-set `bold` value is used.
+                              &quot;fontSize&quot;: { # A magnitude in a single direction in the specified units. # The size of the text&#x27;s font. When read, the `font_size` will specified in points.
+                                &quot;magnitude&quot;: 3.14, # The magnitude.
+                                &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                              },
+                              &quot;foregroundColor&quot;: { # A color that can either be fully opaque or fully transparent. # The color of the text itself. If set, the color is either opaque or transparent, depending on if the `opaque_color` field in it is set.
+                                &quot;opaqueColor&quot;: { # A themeable solid color value. # If set, this will be used as an opaque color. If unset, this represents a transparent color.
+                                  &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                                    &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                                    &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                                    &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                                  },
+                                  &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                                },
+                              },
+                              &quot;italic&quot;: True or False, # Whether or not the text is italicized.
+                              &quot;link&quot;: { # A hypertext link. # The hyperlink destination of the text. If unset, there is no link. Links are not inherited from parent text. Changing the link in an update request causes some other changes to the text style of the range: * When setting a link, the text foreground color will be set to ThemeColorType.HYPERLINK and the text will be underlined. If these fields are modified in the same request, those values will be used instead of the link defaults. * Setting a link on a text range that overlaps with an existing link will also update the existing link to point to the new URL. * Links are not settable on newline characters. As a result, setting a link on a text range that crosses a paragraph boundary, such as `&quot;ABC\n123&quot;`, will separate the newline character(s) into their own text runs. The link will be applied separately to the runs before and after the newline. * Removing a link will update the text style of the range to match the style of the preceding text (or the default text styles if the preceding text is another link) unless different styles are being set in the same request.
+                                &quot;pageObjectId&quot;: &quot;A String&quot;, # If set, indicates this is a link to the specific page in this presentation with this ID. A page with this ID may not exist.
+                                &quot;relativeLink&quot;: &quot;A String&quot;, # If set, indicates this is a link to a slide in this presentation, addressed by its position.
+                                &quot;slideIndex&quot;: 42, # If set, indicates this is a link to the slide at this zero-based index in the presentation. There may not be a slide at this index.
+                                &quot;url&quot;: &quot;A String&quot;, # If set, indicates this is a link to the external web page at this URL.
+                              },
+                              &quot;smallCaps&quot;: True or False, # Whether or not the text is in small capital letters.
+                              &quot;strikethrough&quot;: True or False, # Whether or not the text is struck through.
+                              &quot;underline&quot;: True or False, # Whether or not the text is underlined.
+                              &quot;weightedFontFamily&quot;: { # Represents a font family and weight used to style a TextRun. # The font family and rendered weight of the text. This field is an extension of `font_family` meant to support explicit font weights without breaking backwards compatibility. As such, when reading the style of a range of text, the value of `weighted_font_family#font_family` will always be equal to that of `font_family`. However, when writing, if both fields are included in the field mask (either explicitly or through the wildcard `&quot;*&quot;`), their values are reconciled as follows: * If `font_family` is set and `weighted_font_family` is not, the value of `font_family` is applied with weight `400` (&quot;normal&quot;). * If both fields are set, the value of `font_family` must match that of `weighted_font_family#font_family`. If so, the font family and weight of `weighted_font_family` is applied. Otherwise, a 400 bad request error is returned. * If `weighted_font_family` is set and `font_family` is not, the font family and weight of `weighted_font_family` is applied. * If neither field is set, the font family and weight of the text inherit from the parent. Note that these properties cannot inherit separately from each other. If an update request specifies values for both `weighted_font_family` and `bold`, the `weighted_font_family` is applied first, then `bold`. If `weighted_font_family#weight` is not set, it defaults to `400`. If `weighted_font_family` is set, then `weighted_font_family#font_family` must also be set with a non-empty value. Otherwise, a 400 bad request error is returned.
+                                &quot;fontFamily&quot;: &quot;A String&quot;, # The font family of the text. The font family can be any font from the Font menu in Slides or from [Google Fonts] (https://fonts.google.com/). If the font name is unrecognized, the text is rendered in `Arial`.
+                                &quot;weight&quot;: 42, # The rendered weight of the text. This field can have any value that is a multiple of `100` between `100` and `900`, inclusive. This range corresponds to the numerical values described in the CSS 2.1 Specification, [section 15.6](https://www.w3.org/TR/CSS21/fonts.html#font-boldness), with non-numerical values disallowed. Weights greater than or equal to `700` are considered bold, and weights less than `700`are not bold. The default value is `400` (&quot;normal&quot;).
+                              },
+                            },
+                            &quot;glyph&quot;: &quot;A String&quot;, # The rendered bullet glyph for this paragraph.
+                            &quot;listId&quot;: &quot;A String&quot;, # The ID of the list this paragraph belongs to.
+                            &quot;nestingLevel&quot;: 42, # The nesting level of this paragraph in the list.
+                          },
+                          &quot;style&quot;: { # Styles that apply to a whole paragraph. If this text is contained in a shape with a parent placeholder, then these paragraph styles may be inherited from the parent. Which paragraph styles are inherited depend on the nesting level of lists: * A paragraph not in a list will inherit its paragraph style from the paragraph at the 0 nesting level of the list inside the parent placeholder. * A paragraph in a list will inherit its paragraph style from the paragraph at its corresponding nesting level of the list inside the parent placeholder. Inherited paragraph styles are represented as unset fields in this message. # The paragraph&#x27;s style
+                            &quot;alignment&quot;: &quot;A String&quot;, # The text alignment for this paragraph.
+                            &quot;direction&quot;: &quot;A String&quot;, # The text direction of this paragraph. If unset, the value defaults to LEFT_TO_RIGHT since text direction is not inherited.
+                            &quot;indentEnd&quot;: { # A magnitude in a single direction in the specified units. # The amount indentation for the paragraph on the side that corresponds to the end of the text, based on the current text direction. If unset, the value is inherited from the parent.
+                              &quot;magnitude&quot;: 3.14, # The magnitude.
+                              &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                            },
+                            &quot;indentFirstLine&quot;: { # A magnitude in a single direction in the specified units. # The amount of indentation for the start of the first line of the paragraph. If unset, the value is inherited from the parent.
+                              &quot;magnitude&quot;: 3.14, # The magnitude.
+                              &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                            },
+                            &quot;indentStart&quot;: { # A magnitude in a single direction in the specified units. # The amount indentation for the paragraph on the side that corresponds to the start of the text, based on the current text direction. If unset, the value is inherited from the parent.
+                              &quot;magnitude&quot;: 3.14, # The magnitude.
+                              &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                            },
+                            &quot;lineSpacing&quot;: 3.14, # The amount of space between lines, as a percentage of normal, where normal is represented as 100.0. If unset, the value is inherited from the parent.
+                            &quot;spaceAbove&quot;: { # A magnitude in a single direction in the specified units. # The amount of extra space above the paragraph. If unset, the value is inherited from the parent.
+                              &quot;magnitude&quot;: 3.14, # The magnitude.
+                              &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                            },
+                            &quot;spaceBelow&quot;: { # A magnitude in a single direction in the specified units. # The amount of extra space below the paragraph. If unset, the value is inherited from the parent.
+                              &quot;magnitude&quot;: 3.14, # The magnitude.
+                              &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                            },
+                            &quot;spacingMode&quot;: &quot;A String&quot;, # The spacing mode for the paragraph.
+                          },
+                        },
+                        &quot;startIndex&quot;: 42, # The zero-based start index of this text element, in Unicode code units.
+                        &quot;textRun&quot;: { # A TextElement kind that represents a run of text that all has the same styling. # A TextElement representing a run of text where all of the characters in the run have the same TextStyle. The `start_index` and `end_index` of TextRuns will always be fully contained in the index range of a single `paragraph_marker` TextElement. In other words, a TextRun will never span multiple paragraphs.
+                          &quot;content&quot;: &quot;A String&quot;, # The text of this run.
+                          &quot;style&quot;: { # Represents the styling that can be applied to a TextRun. If this text is contained in a shape with a parent placeholder, then these text styles may be inherited from the parent. Which text styles are inherited depend on the nesting level of lists: * A text run in a paragraph that is not in a list will inherit its text style from the the newline character in the paragraph at the 0 nesting level of the list inside the parent placeholder. * A text run in a paragraph that is in a list will inherit its text style from the newline character in the paragraph at its corresponding nesting level of the list inside the parent placeholder. Inherited text styles are represented as unset fields in this message. If text is contained in a shape without a parent placeholder, unsetting these fields will revert the style to a value matching the defaults in the Slides editor. # The styling applied to this run.
+                            &quot;backgroundColor&quot;: { # A color that can either be fully opaque or fully transparent. # The background color of the text. If set, the color is either opaque or transparent, depending on if the `opaque_color` field in it is set.
+                              &quot;opaqueColor&quot;: { # A themeable solid color value. # If set, this will be used as an opaque color. If unset, this represents a transparent color.
+                                &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                                  &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                                  &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                                  &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                                },
+                                &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                              },
+                            },
+                            &quot;baselineOffset&quot;: &quot;A String&quot;, # The text&#x27;s vertical offset from its normal position. Text with `SUPERSCRIPT` or `SUBSCRIPT` baseline offsets is automatically rendered in a smaller font size, computed based on the `font_size` field. The `font_size` itself is not affected by changes in this field.
+                            &quot;bold&quot;: True or False, # Whether or not the text is rendered as bold.
+                            &quot;fontFamily&quot;: &quot;A String&quot;, # The font family of the text. The font family can be any font from the Font menu in Slides or from [Google Fonts] (https://fonts.google.com/). If the font name is unrecognized, the text is rendered in `Arial`. Some fonts can affect the weight of the text. If an update request specifies values for both `font_family` and `bold`, the explicitly-set `bold` value is used.
+                            &quot;fontSize&quot;: { # A magnitude in a single direction in the specified units. # The size of the text&#x27;s font. When read, the `font_size` will specified in points.
+                              &quot;magnitude&quot;: 3.14, # The magnitude.
+                              &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                            },
+                            &quot;foregroundColor&quot;: { # A color that can either be fully opaque or fully transparent. # The color of the text itself. If set, the color is either opaque or transparent, depending on if the `opaque_color` field in it is set.
+                              &quot;opaqueColor&quot;: { # A themeable solid color value. # If set, this will be used as an opaque color. If unset, this represents a transparent color.
+                                &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                                  &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                                  &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                                  &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                                },
+                                &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                              },
+                            },
+                            &quot;italic&quot;: True or False, # Whether or not the text is italicized.
+                            &quot;link&quot;: { # A hypertext link. # The hyperlink destination of the text. If unset, there is no link. Links are not inherited from parent text. Changing the link in an update request causes some other changes to the text style of the range: * When setting a link, the text foreground color will be set to ThemeColorType.HYPERLINK and the text will be underlined. If these fields are modified in the same request, those values will be used instead of the link defaults. * Setting a link on a text range that overlaps with an existing link will also update the existing link to point to the new URL. * Links are not settable on newline characters. As a result, setting a link on a text range that crosses a paragraph boundary, such as `&quot;ABC\n123&quot;`, will separate the newline character(s) into their own text runs. The link will be applied separately to the runs before and after the newline. * Removing a link will update the text style of the range to match the style of the preceding text (or the default text styles if the preceding text is another link) unless different styles are being set in the same request.
+                              &quot;pageObjectId&quot;: &quot;A String&quot;, # If set, indicates this is a link to the specific page in this presentation with this ID. A page with this ID may not exist.
+                              &quot;relativeLink&quot;: &quot;A String&quot;, # If set, indicates this is a link to a slide in this presentation, addressed by its position.
+                              &quot;slideIndex&quot;: 42, # If set, indicates this is a link to the slide at this zero-based index in the presentation. There may not be a slide at this index.
+                              &quot;url&quot;: &quot;A String&quot;, # If set, indicates this is a link to the external web page at this URL.
+                            },
+                            &quot;smallCaps&quot;: True or False, # Whether or not the text is in small capital letters.
+                            &quot;strikethrough&quot;: True or False, # Whether or not the text is struck through.
+                            &quot;underline&quot;: True or False, # Whether or not the text is underlined.
+                            &quot;weightedFontFamily&quot;: { # Represents a font family and weight used to style a TextRun. # The font family and rendered weight of the text. This field is an extension of `font_family` meant to support explicit font weights without breaking backwards compatibility. As such, when reading the style of a range of text, the value of `weighted_font_family#font_family` will always be equal to that of `font_family`. However, when writing, if both fields are included in the field mask (either explicitly or through the wildcard `&quot;*&quot;`), their values are reconciled as follows: * If `font_family` is set and `weighted_font_family` is not, the value of `font_family` is applied with weight `400` (&quot;normal&quot;). * If both fields are set, the value of `font_family` must match that of `weighted_font_family#font_family`. If so, the font family and weight of `weighted_font_family` is applied. Otherwise, a 400 bad request error is returned. * If `weighted_font_family` is set and `font_family` is not, the font family and weight of `weighted_font_family` is applied. * If neither field is set, the font family and weight of the text inherit from the parent. Note that these properties cannot inherit separately from each other. If an update request specifies values for both `weighted_font_family` and `bold`, the `weighted_font_family` is applied first, then `bold`. If `weighted_font_family#weight` is not set, it defaults to `400`. If `weighted_font_family` is set, then `weighted_font_family#font_family` must also be set with a non-empty value. Otherwise, a 400 bad request error is returned.
+                              &quot;fontFamily&quot;: &quot;A String&quot;, # The font family of the text. The font family can be any font from the Font menu in Slides or from [Google Fonts] (https://fonts.google.com/). If the font name is unrecognized, the text is rendered in `Arial`.
+                              &quot;weight&quot;: 42, # The rendered weight of the text. This field can have any value that is a multiple of `100` between `100` and `900`, inclusive. This range corresponds to the numerical values described in the CSS 2.1 Specification, [section 15.6](https://www.w3.org/TR/CSS21/fonts.html#font-boldness), with non-numerical values disallowed. Weights greater than or equal to `700` are considered bold, and weights less than `700`are not bold. The default value is `400` (&quot;normal&quot;).
+                            },
+                          },
+                        },
+                      },
+                    ],
+                  },
+                },
+                &quot;sheetsChart&quot;: { # A PageElement kind representing a linked chart embedded from Google Sheets. # A linked chart embedded from Google Sheets. Unlinked charts are represented as images.
+                  &quot;chartId&quot;: 42, # The ID of the specific chart in the Google Sheets spreadsheet that is embedded.
+                  &quot;contentUrl&quot;: &quot;A String&quot;, # The URL of an image of the embedded chart, with a default lifetime of 30 minutes. This URL is tagged with the account of the requester. Anyone with the URL effectively accesses the image as the original requester. Access to the image may be lost if the presentation&#x27;s sharing settings change.
+                  &quot;sheetsChartProperties&quot;: { # The properties of the SheetsChart. # The properties of the Sheets chart.
+                    &quot;chartImageProperties&quot;: { # The properties of the Image. # The properties of the embedded chart image.
+                      &quot;brightness&quot;: 3.14, # The brightness effect of the image. The value should be in the interval [-1.0, 1.0], where 0 means no effect. This property is read-only.
+                      &quot;contrast&quot;: 3.14, # The contrast effect of the image. The value should be in the interval [-1.0, 1.0], where 0 means no effect. This property is read-only.
+                      &quot;cropProperties&quot;: { # The crop properties of an object enclosed in a container. For example, an Image. The crop properties is represented by the offsets of four edges which define a crop rectangle. The offsets are measured in percentage from the corresponding edges of the object&#x27;s original bounding rectangle towards inside, relative to the object&#x27;s original dimensions. - If the offset is in the interval (0, 1), the corresponding edge of crop rectangle is positioned inside of the object&#x27;s original bounding rectangle. - If the offset is negative or greater than 1, the corresponding edge of crop rectangle is positioned outside of the object&#x27;s original bounding rectangle. - If the left edge of the crop rectangle is on the right side of its right edge, the object will be flipped horizontally. - If the top edge of the crop rectangle is below its bottom edge, the object will be flipped vertically. - If all offsets and rotation angle is 0, the object is not cropped. After cropping, the content in the crop rectangle will be stretched to fit its container. # The crop properties of the image. If not set, the image is not cropped. This property is read-only.
+                        &quot;angle&quot;: 3.14, # The rotation angle of the crop window around its center, in radians. Rotation angle is applied after the offset.
+                        &quot;bottomOffset&quot;: 3.14, # The offset specifies the bottom edge of the crop rectangle that is located above the original bounding rectangle bottom edge, relative to the object&#x27;s original height.
+                        &quot;leftOffset&quot;: 3.14, # The offset specifies the left edge of the crop rectangle that is located to the right of the original bounding rectangle left edge, relative to the object&#x27;s original width.
+                        &quot;rightOffset&quot;: 3.14, # The offset specifies the right edge of the crop rectangle that is located to the left of the original bounding rectangle right edge, relative to the object&#x27;s original width.
+                        &quot;topOffset&quot;: 3.14, # The offset specifies the top edge of the crop rectangle that is located below the original bounding rectangle top edge, relative to the object&#x27;s original height.
+                      },
+                      &quot;link&quot;: { # A hypertext link. # The hyperlink destination of the image. If unset, there is no link.
+                        &quot;pageObjectId&quot;: &quot;A String&quot;, # If set, indicates this is a link to the specific page in this presentation with this ID. A page with this ID may not exist.
+                        &quot;relativeLink&quot;: &quot;A String&quot;, # If set, indicates this is a link to a slide in this presentation, addressed by its position.
+                        &quot;slideIndex&quot;: 42, # If set, indicates this is a link to the slide at this zero-based index in the presentation. There may not be a slide at this index.
+                        &quot;url&quot;: &quot;A String&quot;, # If set, indicates this is a link to the external web page at this URL.
+                      },
+                      &quot;outline&quot;: { # The outline of a PageElement. If these fields are unset, they may be inherited from a parent placeholder if it exists. If there is no parent, the fields will default to the value used for new page elements created in the Slides editor, which may depend on the page element kind. # The outline of the image. If not set, the image has no outline.
+                        &quot;dashStyle&quot;: &quot;A String&quot;, # The dash style of the outline.
+                        &quot;outlineFill&quot;: { # The fill of the outline. # The fill of the outline.
+                          &quot;solidFill&quot;: { # A solid color fill. The page or page element is filled entirely with the specified color value. If any field is unset, its value may be inherited from a parent placeholder if it exists. # Solid color fill.
+                            &quot;alpha&quot;: 3.14, # The fraction of this `color` that should be applied to the pixel. That is, the final pixel color is defined by the equation: pixel color = alpha * (color) + (1.0 - alpha) * (background color) This means that a value of 1.0 corresponds to a solid color, whereas a value of 0.0 corresponds to a completely transparent color.
+                            &quot;color&quot;: { # A themeable solid color value. # The color value of the solid fill.
+                              &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                                &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                                &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                                &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                              },
+                              &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                            },
+                          },
+                        },
+                        &quot;propertyState&quot;: &quot;A String&quot;, # The outline property state. Updating the outline on a page element will implicitly update this field to `RENDERED`, unless another value is specified in the same request. To have no outline on a page element, set this field to `NOT_RENDERED`. In this case, any other outline fields set in the same request will be ignored.
+                        &quot;weight&quot;: { # A magnitude in a single direction in the specified units. # The thickness of the outline.
+                          &quot;magnitude&quot;: 3.14, # The magnitude.
+                          &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                        },
+                      },
+                      &quot;recolor&quot;: { # A recolor effect applied on an image. # The recolor effect of the image. If not set, the image is not recolored. This property is read-only.
+                        &quot;name&quot;: &quot;A String&quot;, # The name of the recolor effect. The name is determined from the `recolor_stops` by matching the gradient against the colors in the page&#x27;s current color scheme. This property is read-only.
+                        &quot;recolorStops&quot;: [ # The recolor effect is represented by a gradient, which is a list of color stops. The colors in the gradient will replace the corresponding colors at the same position in the color palette and apply to the image. This property is read-only.
+                          { # A color and position in a gradient band.
+                            &quot;alpha&quot;: 3.14, # The alpha value of this color in the gradient band. Defaults to 1.0, fully opaque.
+                            &quot;color&quot;: { # A themeable solid color value. # The color of the gradient stop.
+                              &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                                &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                                &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                                &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                              },
+                              &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                            },
+                            &quot;position&quot;: 3.14, # The relative position of the color stop in the gradient band measured in percentage. The value should be in the interval [0.0, 1.0].
+                          },
+                        ],
+                      },
+                      &quot;shadow&quot;: { # The shadow properties of a page element. If these fields are unset, they may be inherited from a parent placeholder if it exists. If there is no parent, the fields will default to the value used for new page elements created in the Slides editor, which may depend on the page element kind. # The shadow of the image. If not set, the image has no shadow. This property is read-only.
+                        &quot;alignment&quot;: &quot;A String&quot;, # The alignment point of the shadow, that sets the origin for translate, scale and skew of the shadow. This property is read-only.
+                        &quot;alpha&quot;: 3.14, # The alpha of the shadow&#x27;s color, from 0.0 to 1.0.
+                        &quot;blurRadius&quot;: { # A magnitude in a single direction in the specified units. # The radius of the shadow blur. The larger the radius, the more diffuse the shadow becomes.
+                          &quot;magnitude&quot;: 3.14, # The magnitude.
+                          &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                        },
+                        &quot;color&quot;: { # A themeable solid color value. # The shadow color value.
+                          &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                            &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                            &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                            &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                          },
+                          &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                        },
+                        &quot;propertyState&quot;: &quot;A String&quot;, # The shadow property state. Updating the shadow on a page element will implicitly update this field to `RENDERED`, unless another value is specified in the same request. To have no shadow on a page element, set this field to `NOT_RENDERED`. In this case, any other shadow fields set in the same request will be ignored.
+                        &quot;rotateWithShape&quot;: True or False, # Whether the shadow should rotate with the shape. This property is read-only.
+                        &quot;transform&quot;: { # AffineTransform uses a 3x3 matrix with an implied last row of [ 0 0 1 ] to transform source coordinates (x,y) into destination coordinates (x&#x27;, y&#x27;) according to: x&#x27; x = shear_y scale_y translate_y 1 [ 1 ] After transformation, x&#x27; = scale_x * x + shear_x * y + translate_x; y&#x27; = scale_y * y + shear_y * x + translate_y; This message is therefore composed of these six matrix elements. # Transform that encodes the translate, scale, and skew of the shadow, relative to the alignment position.
+                          &quot;scaleX&quot;: 3.14, # The X coordinate scaling element.
+                          &quot;scaleY&quot;: 3.14, # The Y coordinate scaling element.
+                          &quot;shearX&quot;: 3.14, # The X coordinate shearing element.
+                          &quot;shearY&quot;: 3.14, # The Y coordinate shearing element.
+                          &quot;translateX&quot;: 3.14, # The X coordinate translation element.
+                          &quot;translateY&quot;: 3.14, # The Y coordinate translation element.
+                          &quot;unit&quot;: &quot;A String&quot;, # The units for translate elements.
+                        },
+                        &quot;type&quot;: &quot;A String&quot;, # The type of the shadow. This property is read-only.
+                      },
+                      &quot;transparency&quot;: 3.14, # The transparency effect of the image. The value should be in the interval [0.0, 1.0], where 0 means no effect and 1 means completely transparent. This property is read-only.
+                    },
+                  },
+                  &quot;spreadsheetId&quot;: &quot;A String&quot;, # The ID of the Google Sheets spreadsheet that contains the source chart.
+                },
+                &quot;size&quot;: { # A width and height. # The size of the page element.
+                  &quot;height&quot;: { # A magnitude in a single direction in the specified units. # The height of the object.
+                    &quot;magnitude&quot;: 3.14, # The magnitude.
+                    &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                  },
+                  &quot;width&quot;: { # A magnitude in a single direction in the specified units. # The width of the object.
+                    &quot;magnitude&quot;: 3.14, # The magnitude.
+                    &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                  },
+                },
+                &quot;table&quot;: { # A PageElement kind representing a table. # A table page element.
+                  &quot;columns&quot;: 42, # Number of columns in the table.
+                  &quot;horizontalBorderRows&quot;: [ # Properties of horizontal cell borders. A table&#x27;s horizontal cell borders are represented as a grid. The grid has one more row than the number of rows in the table and the same number of columns as the table. For example, if the table is 3 x 3, its horizontal borders will be represented as a grid with 4 rows and 3 columns.
+                    { # Contents of each border row in a table.
+                      &quot;tableBorderCells&quot;: [ # Properties of each border cell. When a border&#x27;s adjacent table cells are merged, it is not included in the response.
+                        { # The properties of each border cell.
+                          &quot;location&quot;: { # A location of a single table cell within a table. # The location of the border within the border table.
+                            &quot;columnIndex&quot;: 42, # The 0-based column index.
+                            &quot;rowIndex&quot;: 42, # The 0-based row index.
+                          },
+                          &quot;tableBorderProperties&quot;: { # The border styling properties of the TableBorderCell. # The border properties.
+                            &quot;dashStyle&quot;: &quot;A String&quot;, # The dash style of the border.
+                            &quot;tableBorderFill&quot;: { # The fill of the border. # The fill of the table border.
+                              &quot;solidFill&quot;: { # A solid color fill. The page or page element is filled entirely with the specified color value. If any field is unset, its value may be inherited from a parent placeholder if it exists. # Solid fill.
+                                &quot;alpha&quot;: 3.14, # The fraction of this `color` that should be applied to the pixel. That is, the final pixel color is defined by the equation: pixel color = alpha * (color) + (1.0 - alpha) * (background color) This means that a value of 1.0 corresponds to a solid color, whereas a value of 0.0 corresponds to a completely transparent color.
+                                &quot;color&quot;: { # A themeable solid color value. # The color value of the solid fill.
+                                  &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                                    &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                                    &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                                    &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                                  },
+                                  &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                                },
+                              },
+                            },
+                            &quot;weight&quot;: { # A magnitude in a single direction in the specified units. # The thickness of the border.
+                              &quot;magnitude&quot;: 3.14, # The magnitude.
+                              &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                            },
+                          },
+                        },
+                      ],
+                    },
+                  ],
+                  &quot;rows&quot;: 42, # Number of rows in the table.
+                  &quot;tableColumns&quot;: [ # Properties of each column.
+                    { # Properties of each column in a table.
+                      &quot;columnWidth&quot;: { # A magnitude in a single direction in the specified units. # Width of a column.
+                        &quot;magnitude&quot;: 3.14, # The magnitude.
+                        &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                      },
+                    },
+                  ],
+                  &quot;tableRows&quot;: [ # Properties and contents of each row. Cells that span multiple rows are contained in only one of these rows and have a row_span greater than 1.
+                    { # Properties and contents of each row in a table.
+                      &quot;rowHeight&quot;: { # A magnitude in a single direction in the specified units. # Height of a row.
+                        &quot;magnitude&quot;: 3.14, # The magnitude.
+                        &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                      },
+                      &quot;tableCells&quot;: [ # Properties and contents of each cell. Cells that span multiple columns are represented only once with a column_span greater than 1. As a result, the length of this collection does not always match the number of columns of the entire table.
+                        { # Properties and contents of each table cell.
+                          &quot;columnSpan&quot;: 42, # Column span of the cell.
+                          &quot;location&quot;: { # A location of a single table cell within a table. # The location of the cell within the table.
+                            &quot;columnIndex&quot;: 42, # The 0-based column index.
+                            &quot;rowIndex&quot;: 42, # The 0-based row index.
+                          },
+                          &quot;rowSpan&quot;: 42, # Row span of the cell.
+                          &quot;tableCellProperties&quot;: { # The properties of the TableCell. # The properties of the table cell.
+                            &quot;contentAlignment&quot;: &quot;A String&quot;, # The alignment of the content in the table cell. The default alignment matches the alignment for newly created table cells in the Slides editor.
+                            &quot;tableCellBackgroundFill&quot;: { # The table cell background fill. # The background fill of the table cell. The default fill matches the fill for newly created table cells in the Slides editor.
+                              &quot;propertyState&quot;: &quot;A String&quot;, # The background fill property state. Updating the fill on a table cell will implicitly update this field to `RENDERED`, unless another value is specified in the same request. To have no fill on a table cell, set this field to `NOT_RENDERED`. In this case, any other fill fields set in the same request will be ignored.
+                              &quot;solidFill&quot;: { # A solid color fill. The page or page element is filled entirely with the specified color value. If any field is unset, its value may be inherited from a parent placeholder if it exists. # Solid color fill.
+                                &quot;alpha&quot;: 3.14, # The fraction of this `color` that should be applied to the pixel. That is, the final pixel color is defined by the equation: pixel color = alpha * (color) + (1.0 - alpha) * (background color) This means that a value of 1.0 corresponds to a solid color, whereas a value of 0.0 corresponds to a completely transparent color.
+                                &quot;color&quot;: { # A themeable solid color value. # The color value of the solid fill.
+                                  &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                                    &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                                    &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                                    &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                                  },
+                                  &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                                },
+                              },
+                            },
+                          },
+                          &quot;text&quot;: { # The general text content. The text must reside in a compatible shape (e.g. text box or rectangle) or a table cell in a page. # The text content of the cell.
+                            &quot;lists&quot;: { # The bulleted lists contained in this text, keyed by list ID.
+                              &quot;a_key&quot;: { # A List describes the look and feel of bullets belonging to paragraphs associated with a list. A paragraph that is part of a list has an implicit reference to that list&#x27;s ID.
+                                &quot;listId&quot;: &quot;A String&quot;, # The ID of the list.
+                                &quot;nestingLevel&quot;: { # A map of nesting levels to the properties of bullets at the associated level. A list has at most nine levels of nesting, so the possible values for the keys of this map are 0 through 8, inclusive.
+                                  &quot;a_key&quot;: { # Contains properties describing the look and feel of a list bullet at a given level of nesting.
+                                    &quot;bulletStyle&quot;: { # Represents the styling that can be applied to a TextRun. If this text is contained in a shape with a parent placeholder, then these text styles may be inherited from the parent. Which text styles are inherited depend on the nesting level of lists: * A text run in a paragraph that is not in a list will inherit its text style from the the newline character in the paragraph at the 0 nesting level of the list inside the parent placeholder. * A text run in a paragraph that is in a list will inherit its text style from the newline character in the paragraph at its corresponding nesting level of the list inside the parent placeholder. Inherited text styles are represented as unset fields in this message. If text is contained in a shape without a parent placeholder, unsetting these fields will revert the style to a value matching the defaults in the Slides editor. # The style of a bullet at this level of nesting.
+                                      &quot;backgroundColor&quot;: { # A color that can either be fully opaque or fully transparent. # The background color of the text. If set, the color is either opaque or transparent, depending on if the `opaque_color` field in it is set.
+                                        &quot;opaqueColor&quot;: { # A themeable solid color value. # If set, this will be used as an opaque color. If unset, this represents a transparent color.
+                                          &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                                            &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                                            &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                                            &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                                          },
+                                          &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                                        },
+                                      },
+                                      &quot;baselineOffset&quot;: &quot;A String&quot;, # The text&#x27;s vertical offset from its normal position. Text with `SUPERSCRIPT` or `SUBSCRIPT` baseline offsets is automatically rendered in a smaller font size, computed based on the `font_size` field. The `font_size` itself is not affected by changes in this field.
+                                      &quot;bold&quot;: True or False, # Whether or not the text is rendered as bold.
+                                      &quot;fontFamily&quot;: &quot;A String&quot;, # The font family of the text. The font family can be any font from the Font menu in Slides or from [Google Fonts] (https://fonts.google.com/). If the font name is unrecognized, the text is rendered in `Arial`. Some fonts can affect the weight of the text. If an update request specifies values for both `font_family` and `bold`, the explicitly-set `bold` value is used.
+                                      &quot;fontSize&quot;: { # A magnitude in a single direction in the specified units. # The size of the text&#x27;s font. When read, the `font_size` will specified in points.
+                                        &quot;magnitude&quot;: 3.14, # The magnitude.
+                                        &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                                      },
+                                      &quot;foregroundColor&quot;: { # A color that can either be fully opaque or fully transparent. # The color of the text itself. If set, the color is either opaque or transparent, depending on if the `opaque_color` field in it is set.
+                                        &quot;opaqueColor&quot;: { # A themeable solid color value. # If set, this will be used as an opaque color. If unset, this represents a transparent color.
+                                          &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                                            &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                                            &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                                            &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                                          },
+                                          &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                                        },
+                                      },
+                                      &quot;italic&quot;: True or False, # Whether or not the text is italicized.
+                                      &quot;link&quot;: { # A hypertext link. # The hyperlink destination of the text. If unset, there is no link. Links are not inherited from parent text. Changing the link in an update request causes some other changes to the text style of the range: * When setting a link, the text foreground color will be set to ThemeColorType.HYPERLINK and the text will be underlined. If these fields are modified in the same request, those values will be used instead of the link defaults. * Setting a link on a text range that overlaps with an existing link will also update the existing link to point to the new URL. * Links are not settable on newline characters. As a result, setting a link on a text range that crosses a paragraph boundary, such as `&quot;ABC\n123&quot;`, will separate the newline character(s) into their own text runs. The link will be applied separately to the runs before and after the newline. * Removing a link will update the text style of the range to match the style of the preceding text (or the default text styles if the preceding text is another link) unless different styles are being set in the same request.
+                                        &quot;pageObjectId&quot;: &quot;A String&quot;, # If set, indicates this is a link to the specific page in this presentation with this ID. A page with this ID may not exist.
+                                        &quot;relativeLink&quot;: &quot;A String&quot;, # If set, indicates this is a link to a slide in this presentation, addressed by its position.
+                                        &quot;slideIndex&quot;: 42, # If set, indicates this is a link to the slide at this zero-based index in the presentation. There may not be a slide at this index.
+                                        &quot;url&quot;: &quot;A String&quot;, # If set, indicates this is a link to the external web page at this URL.
+                                      },
+                                      &quot;smallCaps&quot;: True or False, # Whether or not the text is in small capital letters.
+                                      &quot;strikethrough&quot;: True or False, # Whether or not the text is struck through.
+                                      &quot;underline&quot;: True or False, # Whether or not the text is underlined.
+                                      &quot;weightedFontFamily&quot;: { # Represents a font family and weight used to style a TextRun. # The font family and rendered weight of the text. This field is an extension of `font_family` meant to support explicit font weights without breaking backwards compatibility. As such, when reading the style of a range of text, the value of `weighted_font_family#font_family` will always be equal to that of `font_family`. However, when writing, if both fields are included in the field mask (either explicitly or through the wildcard `&quot;*&quot;`), their values are reconciled as follows: * If `font_family` is set and `weighted_font_family` is not, the value of `font_family` is applied with weight `400` (&quot;normal&quot;). * If both fields are set, the value of `font_family` must match that of `weighted_font_family#font_family`. If so, the font family and weight of `weighted_font_family` is applied. Otherwise, a 400 bad request error is returned. * If `weighted_font_family` is set and `font_family` is not, the font family and weight of `weighted_font_family` is applied. * If neither field is set, the font family and weight of the text inherit from the parent. Note that these properties cannot inherit separately from each other. If an update request specifies values for both `weighted_font_family` and `bold`, the `weighted_font_family` is applied first, then `bold`. If `weighted_font_family#weight` is not set, it defaults to `400`. If `weighted_font_family` is set, then `weighted_font_family#font_family` must also be set with a non-empty value. Otherwise, a 400 bad request error is returned.
+                                        &quot;fontFamily&quot;: &quot;A String&quot;, # The font family of the text. The font family can be any font from the Font menu in Slides or from [Google Fonts] (https://fonts.google.com/). If the font name is unrecognized, the text is rendered in `Arial`.
+                                        &quot;weight&quot;: 42, # The rendered weight of the text. This field can have any value that is a multiple of `100` between `100` and `900`, inclusive. This range corresponds to the numerical values described in the CSS 2.1 Specification, [section 15.6](https://www.w3.org/TR/CSS21/fonts.html#font-boldness), with non-numerical values disallowed. Weights greater than or equal to `700` are considered bold, and weights less than `700`are not bold. The default value is `400` (&quot;normal&quot;).
+                                      },
+                                    },
+                                  },
+                                },
+                              },
+                            },
+                            &quot;textElements&quot;: [ # The text contents broken down into its component parts, including styling information. This property is read-only.
+                              { # A TextElement describes the content of a range of indices in the text content of a Shape or TableCell.
+                                &quot;autoText&quot;: { # A TextElement kind that represents auto text. # A TextElement representing a spot in the text that is dynamically replaced with content that can change over time.
+                                  &quot;content&quot;: &quot;A String&quot;, # The rendered content of this auto text, if available.
+                                  &quot;style&quot;: { # Represents the styling that can be applied to a TextRun. If this text is contained in a shape with a parent placeholder, then these text styles may be inherited from the parent. Which text styles are inherited depend on the nesting level of lists: * A text run in a paragraph that is not in a list will inherit its text style from the the newline character in the paragraph at the 0 nesting level of the list inside the parent placeholder. * A text run in a paragraph that is in a list will inherit its text style from the newline character in the paragraph at its corresponding nesting level of the list inside the parent placeholder. Inherited text styles are represented as unset fields in this message. If text is contained in a shape without a parent placeholder, unsetting these fields will revert the style to a value matching the defaults in the Slides editor. # The styling applied to this auto text.
+                                    &quot;backgroundColor&quot;: { # A color that can either be fully opaque or fully transparent. # The background color of the text. If set, the color is either opaque or transparent, depending on if the `opaque_color` field in it is set.
+                                      &quot;opaqueColor&quot;: { # A themeable solid color value. # If set, this will be used as an opaque color. If unset, this represents a transparent color.
+                                        &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                                          &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                                          &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                                          &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                                        },
+                                        &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                                      },
+                                    },
+                                    &quot;baselineOffset&quot;: &quot;A String&quot;, # The text&#x27;s vertical offset from its normal position. Text with `SUPERSCRIPT` or `SUBSCRIPT` baseline offsets is automatically rendered in a smaller font size, computed based on the `font_size` field. The `font_size` itself is not affected by changes in this field.
+                                    &quot;bold&quot;: True or False, # Whether or not the text is rendered as bold.
+                                    &quot;fontFamily&quot;: &quot;A String&quot;, # The font family of the text. The font family can be any font from the Font menu in Slides or from [Google Fonts] (https://fonts.google.com/). If the font name is unrecognized, the text is rendered in `Arial`. Some fonts can affect the weight of the text. If an update request specifies values for both `font_family` and `bold`, the explicitly-set `bold` value is used.
+                                    &quot;fontSize&quot;: { # A magnitude in a single direction in the specified units. # The size of the text&#x27;s font. When read, the `font_size` will specified in points.
+                                      &quot;magnitude&quot;: 3.14, # The magnitude.
+                                      &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                                    },
+                                    &quot;foregroundColor&quot;: { # A color that can either be fully opaque or fully transparent. # The color of the text itself. If set, the color is either opaque or transparent, depending on if the `opaque_color` field in it is set.
+                                      &quot;opaqueColor&quot;: { # A themeable solid color value. # If set, this will be used as an opaque color. If unset, this represents a transparent color.
+                                        &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                                          &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                                          &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                                          &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                                        },
+                                        &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                                      },
+                                    },
+                                    &quot;italic&quot;: True or False, # Whether or not the text is italicized.
+                                    &quot;link&quot;: { # A hypertext link. # The hyperlink destination of the text. If unset, there is no link. Links are not inherited from parent text. Changing the link in an update request causes some other changes to the text style of the range: * When setting a link, the text foreground color will be set to ThemeColorType.HYPERLINK and the text will be underlined. If these fields are modified in the same request, those values will be used instead of the link defaults. * Setting a link on a text range that overlaps with an existing link will also update the existing link to point to the new URL. * Links are not settable on newline characters. As a result, setting a link on a text range that crosses a paragraph boundary, such as `&quot;ABC\n123&quot;`, will separate the newline character(s) into their own text runs. The link will be applied separately to the runs before and after the newline. * Removing a link will update the text style of the range to match the style of the preceding text (or the default text styles if the preceding text is another link) unless different styles are being set in the same request.
+                                      &quot;pageObjectId&quot;: &quot;A String&quot;, # If set, indicates this is a link to the specific page in this presentation with this ID. A page with this ID may not exist.
+                                      &quot;relativeLink&quot;: &quot;A String&quot;, # If set, indicates this is a link to a slide in this presentation, addressed by its position.
+                                      &quot;slideIndex&quot;: 42, # If set, indicates this is a link to the slide at this zero-based index in the presentation. There may not be a slide at this index.
+                                      &quot;url&quot;: &quot;A String&quot;, # If set, indicates this is a link to the external web page at this URL.
+                                    },
+                                    &quot;smallCaps&quot;: True or False, # Whether or not the text is in small capital letters.
+                                    &quot;strikethrough&quot;: True or False, # Whether or not the text is struck through.
+                                    &quot;underline&quot;: True or False, # Whether or not the text is underlined.
+                                    &quot;weightedFontFamily&quot;: { # Represents a font family and weight used to style a TextRun. # The font family and rendered weight of the text. This field is an extension of `font_family` meant to support explicit font weights without breaking backwards compatibility. As such, when reading the style of a range of text, the value of `weighted_font_family#font_family` will always be equal to that of `font_family`. However, when writing, if both fields are included in the field mask (either explicitly or through the wildcard `&quot;*&quot;`), their values are reconciled as follows: * If `font_family` is set and `weighted_font_family` is not, the value of `font_family` is applied with weight `400` (&quot;normal&quot;). * If both fields are set, the value of `font_family` must match that of `weighted_font_family#font_family`. If so, the font family and weight of `weighted_font_family` is applied. Otherwise, a 400 bad request error is returned. * If `weighted_font_family` is set and `font_family` is not, the font family and weight of `weighted_font_family` is applied. * If neither field is set, the font family and weight of the text inherit from the parent. Note that these properties cannot inherit separately from each other. If an update request specifies values for both `weighted_font_family` and `bold`, the `weighted_font_family` is applied first, then `bold`. If `weighted_font_family#weight` is not set, it defaults to `400`. If `weighted_font_family` is set, then `weighted_font_family#font_family` must also be set with a non-empty value. Otherwise, a 400 bad request error is returned.
+                                      &quot;fontFamily&quot;: &quot;A String&quot;, # The font family of the text. The font family can be any font from the Font menu in Slides or from [Google Fonts] (https://fonts.google.com/). If the font name is unrecognized, the text is rendered in `Arial`.
+                                      &quot;weight&quot;: 42, # The rendered weight of the text. This field can have any value that is a multiple of `100` between `100` and `900`, inclusive. This range corresponds to the numerical values described in the CSS 2.1 Specification, [section 15.6](https://www.w3.org/TR/CSS21/fonts.html#font-boldness), with non-numerical values disallowed. Weights greater than or equal to `700` are considered bold, and weights less than `700`are not bold. The default value is `400` (&quot;normal&quot;).
+                                    },
+                                  },
+                                  &quot;type&quot;: &quot;A String&quot;, # The type of this auto text.
+                                },
+                                &quot;endIndex&quot;: 42, # The zero-based end index of this text element, exclusive, in Unicode code units.
+                                &quot;paragraphMarker&quot;: { # A TextElement kind that represents the beginning of a new paragraph. # A marker representing the beginning of a new paragraph. The `start_index` and `end_index` of this TextElement represent the range of the paragraph. Other TextElements with an index range contained inside this paragraph&#x27;s range are considered to be part of this paragraph. The range of indices of two separate paragraphs will never overlap.
+                                  &quot;bullet&quot;: { # Describes the bullet of a paragraph. # The bullet for this paragraph. If not present, the paragraph does not belong to a list.
+                                    &quot;bulletStyle&quot;: { # Represents the styling that can be applied to a TextRun. If this text is contained in a shape with a parent placeholder, then these text styles may be inherited from the parent. Which text styles are inherited depend on the nesting level of lists: * A text run in a paragraph that is not in a list will inherit its text style from the the newline character in the paragraph at the 0 nesting level of the list inside the parent placeholder. * A text run in a paragraph that is in a list will inherit its text style from the newline character in the paragraph at its corresponding nesting level of the list inside the parent placeholder. Inherited text styles are represented as unset fields in this message. If text is contained in a shape without a parent placeholder, unsetting these fields will revert the style to a value matching the defaults in the Slides editor. # The paragraph specific text style applied to this bullet.
+                                      &quot;backgroundColor&quot;: { # A color that can either be fully opaque or fully transparent. # The background color of the text. If set, the color is either opaque or transparent, depending on if the `opaque_color` field in it is set.
+                                        &quot;opaqueColor&quot;: { # A themeable solid color value. # If set, this will be used as an opaque color. If unset, this represents a transparent color.
+                                          &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                                            &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                                            &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                                            &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                                          },
+                                          &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                                        },
+                                      },
+                                      &quot;baselineOffset&quot;: &quot;A String&quot;, # The text&#x27;s vertical offset from its normal position. Text with `SUPERSCRIPT` or `SUBSCRIPT` baseline offsets is automatically rendered in a smaller font size, computed based on the `font_size` field. The `font_size` itself is not affected by changes in this field.
+                                      &quot;bold&quot;: True or False, # Whether or not the text is rendered as bold.
+                                      &quot;fontFamily&quot;: &quot;A String&quot;, # The font family of the text. The font family can be any font from the Font menu in Slides or from [Google Fonts] (https://fonts.google.com/). If the font name is unrecognized, the text is rendered in `Arial`. Some fonts can affect the weight of the text. If an update request specifies values for both `font_family` and `bold`, the explicitly-set `bold` value is used.
+                                      &quot;fontSize&quot;: { # A magnitude in a single direction in the specified units. # The size of the text&#x27;s font. When read, the `font_size` will specified in points.
+                                        &quot;magnitude&quot;: 3.14, # The magnitude.
+                                        &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                                      },
+                                      &quot;foregroundColor&quot;: { # A color that can either be fully opaque or fully transparent. # The color of the text itself. If set, the color is either opaque or transparent, depending on if the `opaque_color` field in it is set.
+                                        &quot;opaqueColor&quot;: { # A themeable solid color value. # If set, this will be used as an opaque color. If unset, this represents a transparent color.
+                                          &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                                            &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                                            &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                                            &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                                          },
+                                          &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                                        },
+                                      },
+                                      &quot;italic&quot;: True or False, # Whether or not the text is italicized.
+                                      &quot;link&quot;: { # A hypertext link. # The hyperlink destination of the text. If unset, there is no link. Links are not inherited from parent text. Changing the link in an update request causes some other changes to the text style of the range: * When setting a link, the text foreground color will be set to ThemeColorType.HYPERLINK and the text will be underlined. If these fields are modified in the same request, those values will be used instead of the link defaults. * Setting a link on a text range that overlaps with an existing link will also update the existing link to point to the new URL. * Links are not settable on newline characters. As a result, setting a link on a text range that crosses a paragraph boundary, such as `&quot;ABC\n123&quot;`, will separate the newline character(s) into their own text runs. The link will be applied separately to the runs before and after the newline. * Removing a link will update the text style of the range to match the style of the preceding text (or the default text styles if the preceding text is another link) unless different styles are being set in the same request.
+                                        &quot;pageObjectId&quot;: &quot;A String&quot;, # If set, indicates this is a link to the specific page in this presentation with this ID. A page with this ID may not exist.
+                                        &quot;relativeLink&quot;: &quot;A String&quot;, # If set, indicates this is a link to a slide in this presentation, addressed by its position.
+                                        &quot;slideIndex&quot;: 42, # If set, indicates this is a link to the slide at this zero-based index in the presentation. There may not be a slide at this index.
+                                        &quot;url&quot;: &quot;A String&quot;, # If set, indicates this is a link to the external web page at this URL.
+                                      },
+                                      &quot;smallCaps&quot;: True or False, # Whether or not the text is in small capital letters.
+                                      &quot;strikethrough&quot;: True or False, # Whether or not the text is struck through.
+                                      &quot;underline&quot;: True or False, # Whether or not the text is underlined.
+                                      &quot;weightedFontFamily&quot;: { # Represents a font family and weight used to style a TextRun. # The font family and rendered weight of the text. This field is an extension of `font_family` meant to support explicit font weights without breaking backwards compatibility. As such, when reading the style of a range of text, the value of `weighted_font_family#font_family` will always be equal to that of `font_family`. However, when writing, if both fields are included in the field mask (either explicitly or through the wildcard `&quot;*&quot;`), their values are reconciled as follows: * If `font_family` is set and `weighted_font_family` is not, the value of `font_family` is applied with weight `400` (&quot;normal&quot;). * If both fields are set, the value of `font_family` must match that of `weighted_font_family#font_family`. If so, the font family and weight of `weighted_font_family` is applied. Otherwise, a 400 bad request error is returned. * If `weighted_font_family` is set and `font_family` is not, the font family and weight of `weighted_font_family` is applied. * If neither field is set, the font family and weight of the text inherit from the parent. Note that these properties cannot inherit separately from each other. If an update request specifies values for both `weighted_font_family` and `bold`, the `weighted_font_family` is applied first, then `bold`. If `weighted_font_family#weight` is not set, it defaults to `400`. If `weighted_font_family` is set, then `weighted_font_family#font_family` must also be set with a non-empty value. Otherwise, a 400 bad request error is returned.
+                                        &quot;fontFamily&quot;: &quot;A String&quot;, # The font family of the text. The font family can be any font from the Font menu in Slides or from [Google Fonts] (https://fonts.google.com/). If the font name is unrecognized, the text is rendered in `Arial`.
+                                        &quot;weight&quot;: 42, # The rendered weight of the text. This field can have any value that is a multiple of `100` between `100` and `900`, inclusive. This range corresponds to the numerical values described in the CSS 2.1 Specification, [section 15.6](https://www.w3.org/TR/CSS21/fonts.html#font-boldness), with non-numerical values disallowed. Weights greater than or equal to `700` are considered bold, and weights less than `700`are not bold. The default value is `400` (&quot;normal&quot;).
+                                      },
+                                    },
+                                    &quot;glyph&quot;: &quot;A String&quot;, # The rendered bullet glyph for this paragraph.
+                                    &quot;listId&quot;: &quot;A String&quot;, # The ID of the list this paragraph belongs to.
+                                    &quot;nestingLevel&quot;: 42, # The nesting level of this paragraph in the list.
+                                  },
+                                  &quot;style&quot;: { # Styles that apply to a whole paragraph. If this text is contained in a shape with a parent placeholder, then these paragraph styles may be inherited from the parent. Which paragraph styles are inherited depend on the nesting level of lists: * A paragraph not in a list will inherit its paragraph style from the paragraph at the 0 nesting level of the list inside the parent placeholder. * A paragraph in a list will inherit its paragraph style from the paragraph at its corresponding nesting level of the list inside the parent placeholder. Inherited paragraph styles are represented as unset fields in this message. # The paragraph&#x27;s style
+                                    &quot;alignment&quot;: &quot;A String&quot;, # The text alignment for this paragraph.
+                                    &quot;direction&quot;: &quot;A String&quot;, # The text direction of this paragraph. If unset, the value defaults to LEFT_TO_RIGHT since text direction is not inherited.
+                                    &quot;indentEnd&quot;: { # A magnitude in a single direction in the specified units. # The amount indentation for the paragraph on the side that corresponds to the end of the text, based on the current text direction. If unset, the value is inherited from the parent.
+                                      &quot;magnitude&quot;: 3.14, # The magnitude.
+                                      &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                                    },
+                                    &quot;indentFirstLine&quot;: { # A magnitude in a single direction in the specified units. # The amount of indentation for the start of the first line of the paragraph. If unset, the value is inherited from the parent.
+                                      &quot;magnitude&quot;: 3.14, # The magnitude.
+                                      &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                                    },
+                                    &quot;indentStart&quot;: { # A magnitude in a single direction in the specified units. # The amount indentation for the paragraph on the side that corresponds to the start of the text, based on the current text direction. If unset, the value is inherited from the parent.
+                                      &quot;magnitude&quot;: 3.14, # The magnitude.
+                                      &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                                    },
+                                    &quot;lineSpacing&quot;: 3.14, # The amount of space between lines, as a percentage of normal, where normal is represented as 100.0. If unset, the value is inherited from the parent.
+                                    &quot;spaceAbove&quot;: { # A magnitude in a single direction in the specified units. # The amount of extra space above the paragraph. If unset, the value is inherited from the parent.
+                                      &quot;magnitude&quot;: 3.14, # The magnitude.
+                                      &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                                    },
+                                    &quot;spaceBelow&quot;: { # A magnitude in a single direction in the specified units. # The amount of extra space below the paragraph. If unset, the value is inherited from the parent.
+                                      &quot;magnitude&quot;: 3.14, # The magnitude.
+                                      &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                                    },
+                                    &quot;spacingMode&quot;: &quot;A String&quot;, # The spacing mode for the paragraph.
+                                  },
+                                },
+                                &quot;startIndex&quot;: 42, # The zero-based start index of this text element, in Unicode code units.
+                                &quot;textRun&quot;: { # A TextElement kind that represents a run of text that all has the same styling. # A TextElement representing a run of text where all of the characters in the run have the same TextStyle. The `start_index` and `end_index` of TextRuns will always be fully contained in the index range of a single `paragraph_marker` TextElement. In other words, a TextRun will never span multiple paragraphs.
+                                  &quot;content&quot;: &quot;A String&quot;, # The text of this run.
+                                  &quot;style&quot;: { # Represents the styling that can be applied to a TextRun. If this text is contained in a shape with a parent placeholder, then these text styles may be inherited from the parent. Which text styles are inherited depend on the nesting level of lists: * A text run in a paragraph that is not in a list will inherit its text style from the the newline character in the paragraph at the 0 nesting level of the list inside the parent placeholder. * A text run in a paragraph that is in a list will inherit its text style from the newline character in the paragraph at its corresponding nesting level of the list inside the parent placeholder. Inherited text styles are represented as unset fields in this message. If text is contained in a shape without a parent placeholder, unsetting these fields will revert the style to a value matching the defaults in the Slides editor. # The styling applied to this run.
+                                    &quot;backgroundColor&quot;: { # A color that can either be fully opaque or fully transparent. # The background color of the text. If set, the color is either opaque or transparent, depending on if the `opaque_color` field in it is set.
+                                      &quot;opaqueColor&quot;: { # A themeable solid color value. # If set, this will be used as an opaque color. If unset, this represents a transparent color.
+                                        &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                                          &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                                          &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                                          &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                                        },
+                                        &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                                      },
+                                    },
+                                    &quot;baselineOffset&quot;: &quot;A String&quot;, # The text&#x27;s vertical offset from its normal position. Text with `SUPERSCRIPT` or `SUBSCRIPT` baseline offsets is automatically rendered in a smaller font size, computed based on the `font_size` field. The `font_size` itself is not affected by changes in this field.
+                                    &quot;bold&quot;: True or False, # Whether or not the text is rendered as bold.
+                                    &quot;fontFamily&quot;: &quot;A String&quot;, # The font family of the text. The font family can be any font from the Font menu in Slides or from [Google Fonts] (https://fonts.google.com/). If the font name is unrecognized, the text is rendered in `Arial`. Some fonts can affect the weight of the text. If an update request specifies values for both `font_family` and `bold`, the explicitly-set `bold` value is used.
+                                    &quot;fontSize&quot;: { # A magnitude in a single direction in the specified units. # The size of the text&#x27;s font. When read, the `font_size` will specified in points.
+                                      &quot;magnitude&quot;: 3.14, # The magnitude.
+                                      &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                                    },
+                                    &quot;foregroundColor&quot;: { # A color that can either be fully opaque or fully transparent. # The color of the text itself. If set, the color is either opaque or transparent, depending on if the `opaque_color` field in it is set.
+                                      &quot;opaqueColor&quot;: { # A themeable solid color value. # If set, this will be used as an opaque color. If unset, this represents a transparent color.
+                                        &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                                          &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                                          &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                                          &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                                        },
+                                        &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                                      },
+                                    },
+                                    &quot;italic&quot;: True or False, # Whether or not the text is italicized.
+                                    &quot;link&quot;: { # A hypertext link. # The hyperlink destination of the text. If unset, there is no link. Links are not inherited from parent text. Changing the link in an update request causes some other changes to the text style of the range: * When setting a link, the text foreground color will be set to ThemeColorType.HYPERLINK and the text will be underlined. If these fields are modified in the same request, those values will be used instead of the link defaults. * Setting a link on a text range that overlaps with an existing link will also update the existing link to point to the new URL. * Links are not settable on newline characters. As a result, setting a link on a text range that crosses a paragraph boundary, such as `&quot;ABC\n123&quot;`, will separate the newline character(s) into their own text runs. The link will be applied separately to the runs before and after the newline. * Removing a link will update the text style of the range to match the style of the preceding text (or the default text styles if the preceding text is another link) unless different styles are being set in the same request.
+                                      &quot;pageObjectId&quot;: &quot;A String&quot;, # If set, indicates this is a link to the specific page in this presentation with this ID. A page with this ID may not exist.
+                                      &quot;relativeLink&quot;: &quot;A String&quot;, # If set, indicates this is a link to a slide in this presentation, addressed by its position.
+                                      &quot;slideIndex&quot;: 42, # If set, indicates this is a link to the slide at this zero-based index in the presentation. There may not be a slide at this index.
+                                      &quot;url&quot;: &quot;A String&quot;, # If set, indicates this is a link to the external web page at this URL.
+                                    },
+                                    &quot;smallCaps&quot;: True or False, # Whether or not the text is in small capital letters.
+                                    &quot;strikethrough&quot;: True or False, # Whether or not the text is struck through.
+                                    &quot;underline&quot;: True or False, # Whether or not the text is underlined.
+                                    &quot;weightedFontFamily&quot;: { # Represents a font family and weight used to style a TextRun. # The font family and rendered weight of the text. This field is an extension of `font_family` meant to support explicit font weights without breaking backwards compatibility. As such, when reading the style of a range of text, the value of `weighted_font_family#font_family` will always be equal to that of `font_family`. However, when writing, if both fields are included in the field mask (either explicitly or through the wildcard `&quot;*&quot;`), their values are reconciled as follows: * If `font_family` is set and `weighted_font_family` is not, the value of `font_family` is applied with weight `400` (&quot;normal&quot;). * If both fields are set, the value of `font_family` must match that of `weighted_font_family#font_family`. If so, the font family and weight of `weighted_font_family` is applied. Otherwise, a 400 bad request error is returned. * If `weighted_font_family` is set and `font_family` is not, the font family and weight of `weighted_font_family` is applied. * If neither field is set, the font family and weight of the text inherit from the parent. Note that these properties cannot inherit separately from each other. If an update request specifies values for both `weighted_font_family` and `bold`, the `weighted_font_family` is applied first, then `bold`. If `weighted_font_family#weight` is not set, it defaults to `400`. If `weighted_font_family` is set, then `weighted_font_family#font_family` must also be set with a non-empty value. Otherwise, a 400 bad request error is returned.
+                                      &quot;fontFamily&quot;: &quot;A String&quot;, # The font family of the text. The font family can be any font from the Font menu in Slides or from [Google Fonts] (https://fonts.google.com/). If the font name is unrecognized, the text is rendered in `Arial`.
+                                      &quot;weight&quot;: 42, # The rendered weight of the text. This field can have any value that is a multiple of `100` between `100` and `900`, inclusive. This range corresponds to the numerical values described in the CSS 2.1 Specification, [section 15.6](https://www.w3.org/TR/CSS21/fonts.html#font-boldness), with non-numerical values disallowed. Weights greater than or equal to `700` are considered bold, and weights less than `700`are not bold. The default value is `400` (&quot;normal&quot;).
+                                    },
+                                  },
+                                },
+                              },
+                            ],
+                          },
+                        },
+                      ],
+                      &quot;tableRowProperties&quot;: { # Properties of each row in a table. # Properties of the row.
+                        &quot;minRowHeight&quot;: { # A magnitude in a single direction in the specified units. # Minimum height of the row. The row will be rendered in the Slides editor at a height equal to or greater than this value in order to show all the text in the row&#x27;s cell(s).
+                          &quot;magnitude&quot;: 3.14, # The magnitude.
+                          &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                        },
+                      },
+                    },
+                  ],
+                  &quot;verticalBorderRows&quot;: [ # Properties of vertical cell borders. A table&#x27;s vertical cell borders are represented as a grid. The grid has the same number of rows as the table and one more column than the number of columns in the table. For example, if the table is 3 x 3, its vertical borders will be represented as a grid with 3 rows and 4 columns.
+                    { # Contents of each border row in a table.
+                      &quot;tableBorderCells&quot;: [ # Properties of each border cell. When a border&#x27;s adjacent table cells are merged, it is not included in the response.
+                        { # The properties of each border cell.
+                          &quot;location&quot;: { # A location of a single table cell within a table. # The location of the border within the border table.
+                            &quot;columnIndex&quot;: 42, # The 0-based column index.
+                            &quot;rowIndex&quot;: 42, # The 0-based row index.
+                          },
+                          &quot;tableBorderProperties&quot;: { # The border styling properties of the TableBorderCell. # The border properties.
+                            &quot;dashStyle&quot;: &quot;A String&quot;, # The dash style of the border.
+                            &quot;tableBorderFill&quot;: { # The fill of the border. # The fill of the table border.
+                              &quot;solidFill&quot;: { # A solid color fill. The page or page element is filled entirely with the specified color value. If any field is unset, its value may be inherited from a parent placeholder if it exists. # Solid fill.
+                                &quot;alpha&quot;: 3.14, # The fraction of this `color` that should be applied to the pixel. That is, the final pixel color is defined by the equation: pixel color = alpha * (color) + (1.0 - alpha) * (background color) This means that a value of 1.0 corresponds to a solid color, whereas a value of 0.0 corresponds to a completely transparent color.
+                                &quot;color&quot;: { # A themeable solid color value. # The color value of the solid fill.
+                                  &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                                    &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                                    &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                                    &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                                  },
+                                  &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                                },
+                              },
+                            },
+                            &quot;weight&quot;: { # A magnitude in a single direction in the specified units. # The thickness of the border.
+                              &quot;magnitude&quot;: 3.14, # The magnitude.
+                              &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                            },
+                          },
+                        },
+                      ],
+                    },
+                  ],
+                },
+                &quot;title&quot;: &quot;A String&quot;, # The title of the page element. Combined with description to display alt text. The field is not supported for Group elements.
+                &quot;transform&quot;: { # AffineTransform uses a 3x3 matrix with an implied last row of [ 0 0 1 ] to transform source coordinates (x,y) into destination coordinates (x&#x27;, y&#x27;) according to: x&#x27; x = shear_y scale_y translate_y 1 [ 1 ] After transformation, x&#x27; = scale_x * x + shear_x * y + translate_x; y&#x27; = scale_y * y + shear_y * x + translate_y; This message is therefore composed of these six matrix elements. # The transform of the page element. The visual appearance of the page element is determined by its absolute transform. To compute the absolute transform, preconcatenate a page element&#x27;s transform with the transforms of all of its parent groups. If the page element is not in a group, its absolute transform is the same as the value in this field. The initial transform for the newly created Group is always the identity transform.
+                  &quot;scaleX&quot;: 3.14, # The X coordinate scaling element.
+                  &quot;scaleY&quot;: 3.14, # The Y coordinate scaling element.
+                  &quot;shearX&quot;: 3.14, # The X coordinate shearing element.
+                  &quot;shearY&quot;: 3.14, # The Y coordinate shearing element.
+                  &quot;translateX&quot;: 3.14, # The X coordinate translation element.
+                  &quot;translateY&quot;: 3.14, # The Y coordinate translation element.
+                  &quot;unit&quot;: &quot;A String&quot;, # The units for translate elements.
+                },
+                &quot;video&quot;: { # A PageElement kind representing a video. # A video page element.
+                  &quot;id&quot;: &quot;A String&quot;, # The video source&#x27;s unique identifier for this video.
+                  &quot;source&quot;: &quot;A String&quot;, # The video source.
+                  &quot;url&quot;: &quot;A String&quot;, # An URL to a video. The URL is valid as long as the source video exists and sharing settings do not change.
+                  &quot;videoProperties&quot;: { # The properties of the Video. # The properties of the video.
+                    &quot;autoPlay&quot;: True or False, # Whether to enable video autoplay when the page is displayed in present mode. Defaults to false.
+                    &quot;end&quot;: 42, # The time at which to end playback, measured in seconds from the beginning of the video. If set, the end time should be after the start time. If not set or if you set this to a value that exceeds the video&#x27;s length, the video will be played until its end.
+                    &quot;mute&quot;: True or False, # Whether to mute the audio during video playback. Defaults to false.
+                    &quot;outline&quot;: { # The outline of a PageElement. If these fields are unset, they may be inherited from a parent placeholder if it exists. If there is no parent, the fields will default to the value used for new page elements created in the Slides editor, which may depend on the page element kind. # The outline of the video. The default outline matches the defaults for new videos created in the Slides editor.
+                      &quot;dashStyle&quot;: &quot;A String&quot;, # The dash style of the outline.
+                      &quot;outlineFill&quot;: { # The fill of the outline. # The fill of the outline.
+                        &quot;solidFill&quot;: { # A solid color fill. The page or page element is filled entirely with the specified color value. If any field is unset, its value may be inherited from a parent placeholder if it exists. # Solid color fill.
+                          &quot;alpha&quot;: 3.14, # The fraction of this `color` that should be applied to the pixel. That is, the final pixel color is defined by the equation: pixel color = alpha * (color) + (1.0 - alpha) * (background color) This means that a value of 1.0 corresponds to a solid color, whereas a value of 0.0 corresponds to a completely transparent color.
+                          &quot;color&quot;: { # A themeable solid color value. # The color value of the solid fill.
+                            &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                              &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                              &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                              &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                            },
+                            &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                          },
+                        },
+                      },
+                      &quot;propertyState&quot;: &quot;A String&quot;, # The outline property state. Updating the outline on a page element will implicitly update this field to `RENDERED`, unless another value is specified in the same request. To have no outline on a page element, set this field to `NOT_RENDERED`. In this case, any other outline fields set in the same request will be ignored.
+                      &quot;weight&quot;: { # A magnitude in a single direction in the specified units. # The thickness of the outline.
+                        &quot;magnitude&quot;: 3.14, # The magnitude.
+                        &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                      },
+                    },
+                    &quot;start&quot;: 42, # The time at which to start playback, measured in seconds from the beginning of the video. If set, the start time should be before the end time. If you set this to a value that exceeds the video&#x27;s length in seconds, the video will be played from the last second. If not set, the video will be played from the beginning.
+                  },
+                },
+                &quot;wordArt&quot;: { # A PageElement kind representing word art. # A word art page element.
+                  &quot;renderedText&quot;: &quot;A String&quot;, # The text rendered as word art.
+                },
+              },
+            ],
+            &quot;pageProperties&quot;: { # The properties of the Page. The page will inherit properties from the parent page. Depending on the page type the hierarchy is defined in either SlideProperties or LayoutProperties. # The properties of the page.
+              &quot;colorScheme&quot;: { # The palette of predefined colors for a page. # The color scheme of the page. If unset, the color scheme is inherited from a parent page. If the page has no parent, the color scheme uses a default Slides color scheme, matching the defaults in the Slides editor. Only the concrete colors of the first 12 ThemeColorTypes are editable. In addition, only the color scheme on `Master` pages can be updated. To update the field, a color scheme containing mappings from all the first 12 ThemeColorTypes to their concrete colors must be provided. Colors for the remaining ThemeColorTypes will be ignored.
+                &quot;colors&quot;: [ # The ThemeColorType and corresponding concrete color pairs.
+                  { # A pair mapping a theme color type to the concrete color it represents.
+                    &quot;color&quot;: { # An RGB color. # The concrete color corresponding to the theme color type above.
+                      &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                      &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                      &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                    },
+                    &quot;type&quot;: &quot;A String&quot;, # The type of the theme color.
+                  },
+                ],
+              },
+              &quot;pageBackgroundFill&quot;: { # The page background fill. # The background fill of the page. If unset, the background fill is inherited from a parent page if it exists. If the page has no parent, then the background fill defaults to the corresponding fill in the Slides editor.
+                &quot;propertyState&quot;: &quot;A String&quot;, # The background fill property state. Updating the fill on a page will implicitly update this field to `RENDERED`, unless another value is specified in the same request. To have no fill on a page, set this field to `NOT_RENDERED`. In this case, any other fill fields set in the same request will be ignored.
+                &quot;solidFill&quot;: { # A solid color fill. The page or page element is filled entirely with the specified color value. If any field is unset, its value may be inherited from a parent placeholder if it exists. # Solid color fill.
+                  &quot;alpha&quot;: 3.14, # The fraction of this `color` that should be applied to the pixel. That is, the final pixel color is defined by the equation: pixel color = alpha * (color) + (1.0 - alpha) * (background color) This means that a value of 1.0 corresponds to a solid color, whereas a value of 0.0 corresponds to a completely transparent color.
+                  &quot;color&quot;: { # A themeable solid color value. # The color value of the solid fill.
+                    &quot;rgbColor&quot;: { # An RGB color. # An opaque RGB color.
+                      &quot;blue&quot;: 3.14, # The blue component of the color, from 0.0 to 1.0.
+                      &quot;green&quot;: 3.14, # The green component of the color, from 0.0 to 1.0.
+                      &quot;red&quot;: 3.14, # The red component of the color, from 0.0 to 1.0.
+                    },
+                    &quot;themeColor&quot;: &quot;A String&quot;, # An opaque theme color.
+                  },
+                },
+                &quot;stretchedPictureFill&quot;: { # The stretched picture fill. The page or page element is filled entirely with the specified picture. The picture is stretched to fit its container. # Stretched picture fill.
+                  &quot;contentUrl&quot;: &quot;A String&quot;, # Reading the content_url: An URL to a picture with a default lifetime of 30 minutes. This URL is tagged with the account of the requester. Anyone with the URL effectively accesses the picture as the original requester. Access to the picture may be lost if the presentation&#x27;s sharing settings change. Writing the content_url: The picture is fetched once at insertion time and a copy is stored for display inside the presentation. Pictures must be less than 50MB in size, cannot exceed 25 megapixels, and must be in one of PNG, JPEG, or GIF format. The provided URL can be at most 2 kB in length.
+                  &quot;size&quot;: { # A width and height. # The original size of the picture fill. This field is read-only.
+                    &quot;height&quot;: { # A magnitude in a single direction in the specified units. # The height of the object.
+                      &quot;magnitude&quot;: 3.14, # The magnitude.
+                      &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                    },
+                    &quot;width&quot;: { # A magnitude in a single direction in the specified units. # The width of the object.
+                      &quot;magnitude&quot;: 3.14, # The magnitude.
+                      &quot;unit&quot;: &quot;A String&quot;, # The units for magnitude.
+                    },
+                  },
+                },
+              },
+            },
+            &quot;pageType&quot;: &quot;A String&quot;, # The type of the page.
+            &quot;revisionId&quot;: &quot;A String&quot;, # The revision ID of the presentation containing this page. Can be used in update requests to assert that the presentation revision hasn&#x27;t changed since the last read operation. Only populated if the user has edit access to the presentation. The format of the revision ID may change over time, so it should be treated opaquely. A returned revision ID is only guaranteed to be valid for 24 hours after it has been returned and cannot be shared across users. If the revision ID is unchanged between calls, then the presentation has not changed. Conversely, a changed ID (for the same presentation and user) usually means the presentation has been updated; however, a changed ID can also be due to internal factors such as ID format changes.
+            &quot;slideProperties&quot;: # Object with schema name: SlideProperties # Slide specific properties. Only set if page_type = SLIDE.
+          },
         },
       },
       &quot;updateSlidesPosition&quot;: { # Updates the position of slides in the presentation. # Updates the position of a set of slides in the presentation.
@@ -2045,12 +3052,7 @@
       },
       &quot;pageType&quot;: &quot;A String&quot;, # The type of the page.
       &quot;revisionId&quot;: &quot;A String&quot;, # The revision ID of the presentation containing this page. Can be used in update requests to assert that the presentation revision hasn&#x27;t changed since the last read operation. Only populated if the user has edit access to the presentation. The format of the revision ID may change over time, so it should be treated opaquely. A returned revision ID is only guaranteed to be valid for 24 hours after it has been returned and cannot be shared across users. If the revision ID is unchanged between calls, then the presentation has not changed. Conversely, a changed ID (for the same presentation and user) usually means the presentation has been updated; however, a changed ID can also be due to internal factors such as ID format changes.
-      &quot;slideProperties&quot;: { # The properties of Page that are only relevant for pages with page_type SLIDE. # Slide specific properties. Only set if page_type = SLIDE.
-        &quot;isSkipped&quot;: True or False, # Whether the slide is skipped in the presentation mode. Defaults to false.
-        &quot;layoutObjectId&quot;: &quot;A String&quot;, # The object ID of the layout that this slide is based on. This property is read-only.
-        &quot;masterObjectId&quot;: &quot;A String&quot;, # The object ID of the master that this slide is based on. This property is read-only.
-        &quot;notesPage&quot;: # Object with schema name: Page # The notes page that this slide is associated with. It defines the visual appearance of a notes page when printing or exporting slides with speaker notes. A notes page inherits properties from the notes master. The placeholder shape with type BODY on the notes page contains the speaker notes for this slide. The ID of this shape is identified by the speakerNotesObjectId field. The notes page is read-only except for the text content and styles of the speaker notes shape. This property is read-only.
-      },
+      &quot;slideProperties&quot;: # Object with schema name: SlideProperties # Slide specific properties. Only set if page_type = SLIDE.
     },
   ],
   &quot;locale&quot;: &quot;A String&quot;, # The locale of the presentation, as an IETF BCP 47 language tag.
@@ -3061,12 +4063,7 @@
       },
       &quot;pageType&quot;: &quot;A String&quot;, # The type of the page.
       &quot;revisionId&quot;: &quot;A String&quot;, # The revision ID of the presentation containing this page. Can be used in update requests to assert that the presentation revision hasn&#x27;t changed since the last read operation. Only populated if the user has edit access to the presentation. The format of the revision ID may change over time, so it should be treated opaquely. A returned revision ID is only guaranteed to be valid for 24 hours after it has been returned and cannot be shared across users. If the revision ID is unchanged between calls, then the presentation has not changed. Conversely, a changed ID (for the same presentation and user) usually means the presentation has been updated; however, a changed ID can also be due to internal factors such as ID format changes.
-      &quot;slideProperties&quot;: { # The properties of Page that are only relevant for pages with page_type SLIDE. # Slide specific properties. Only set if page_type = SLIDE.
-        &quot;isSkipped&quot;: True or False, # Whether the slide is skipped in the presentation mode. Defaults to false.
-        &quot;layoutObjectId&quot;: &quot;A String&quot;, # The object ID of the layout that this slide is based on. This property is read-only.
-        &quot;masterObjectId&quot;: &quot;A String&quot;, # The object ID of the master that this slide is based on. This property is read-only.
-        &quot;notesPage&quot;: # Object with schema name: Page # The notes page that this slide is associated with. It defines the visual appearance of a notes page when printing or exporting slides with speaker notes. A notes page inherits properties from the notes master. The placeholder shape with type BODY on the notes page contains the speaker notes for this slide. The ID of this shape is identified by the speakerNotesObjectId field. The notes page is read-only except for the text content and styles of the speaker notes shape. This property is read-only.
-      },
+      &quot;slideProperties&quot;: # Object with schema name: SlideProperties # Slide specific properties. Only set if page_type = SLIDE.
     },
   ],
   &quot;notesMaster&quot;: { # A page in a presentation. # The notes master in the presentation. It serves three purposes: - Placeholder shapes on a notes master contain the default text styles and shape properties of all placeholder shapes on notes pages. Specifically, a `SLIDE_IMAGE` placeholder shape contains the slide thumbnail, and a `BODY` placeholder shape contains the speaker notes. - The notes master page properties define the common page properties inherited by all notes pages. - Any other shapes on the notes master appear on all notes pages. The notes master is read-only.
@@ -4075,12 +5072,7 @@
     },
     &quot;pageType&quot;: &quot;A String&quot;, # The type of the page.
     &quot;revisionId&quot;: &quot;A String&quot;, # The revision ID of the presentation containing this page. Can be used in update requests to assert that the presentation revision hasn&#x27;t changed since the last read operation. Only populated if the user has edit access to the presentation. The format of the revision ID may change over time, so it should be treated opaquely. A returned revision ID is only guaranteed to be valid for 24 hours after it has been returned and cannot be shared across users. If the revision ID is unchanged between calls, then the presentation has not changed. Conversely, a changed ID (for the same presentation and user) usually means the presentation has been updated; however, a changed ID can also be due to internal factors such as ID format changes.
-    &quot;slideProperties&quot;: { # The properties of Page that are only relevant for pages with page_type SLIDE. # Slide specific properties. Only set if page_type = SLIDE.
-      &quot;isSkipped&quot;: True or False, # Whether the slide is skipped in the presentation mode. Defaults to false.
-      &quot;layoutObjectId&quot;: &quot;A String&quot;, # The object ID of the layout that this slide is based on. This property is read-only.
-      &quot;masterObjectId&quot;: &quot;A String&quot;, # The object ID of the master that this slide is based on. This property is read-only.
-      &quot;notesPage&quot;: # Object with schema name: Page # The notes page that this slide is associated with. It defines the visual appearance of a notes page when printing or exporting slides with speaker notes. A notes page inherits properties from the notes master. The placeholder shape with type BODY on the notes page contains the speaker notes for this slide. The ID of this shape is identified by the speakerNotesObjectId field. The notes page is read-only except for the text content and styles of the speaker notes shape. This property is read-only.
-    },
+    &quot;slideProperties&quot;: # Object with schema name: SlideProperties # Slide specific properties. Only set if page_type = SLIDE.
   },
   &quot;pageSize&quot;: { # A width and height. # The size of pages in the presentation.
     &quot;height&quot;: { # A magnitude in a single direction in the specified units. # The height of the object.
@@ -5101,12 +6093,7 @@
       },
       &quot;pageType&quot;: &quot;A String&quot;, # The type of the page.
       &quot;revisionId&quot;: &quot;A String&quot;, # The revision ID of the presentation containing this page. Can be used in update requests to assert that the presentation revision hasn&#x27;t changed since the last read operation. Only populated if the user has edit access to the presentation. The format of the revision ID may change over time, so it should be treated opaquely. A returned revision ID is only guaranteed to be valid for 24 hours after it has been returned and cannot be shared across users. If the revision ID is unchanged between calls, then the presentation has not changed. Conversely, a changed ID (for the same presentation and user) usually means the presentation has been updated; however, a changed ID can also be due to internal factors such as ID format changes.
-      &quot;slideProperties&quot;: { # The properties of Page that are only relevant for pages with page_type SLIDE. # Slide specific properties. Only set if page_type = SLIDE.
-        &quot;isSkipped&quot;: True or False, # Whether the slide is skipped in the presentation mode. Defaults to false.
-        &quot;layoutObjectId&quot;: &quot;A String&quot;, # The object ID of the layout that this slide is based on. This property is read-only.
-        &quot;masterObjectId&quot;: &quot;A String&quot;, # The object ID of the master that this slide is based on. This property is read-only.
-        &quot;notesPage&quot;: # Object with schema name: Page # The notes page that this slide is associated with. It defines the visual appearance of a notes page when printing or exporting slides with speaker notes. A notes page inherits properties from the notes master. The placeholder shape with type BODY on the notes page contains the speaker notes for this slide. The ID of this shape is identified by the speakerNotesObjectId field. The notes page is read-only except for the text content and styles of the speaker notes shape. This property is read-only.
-      },
+      &quot;slideProperties&quot;: # Object with schema name: SlideProperties # Slide specific properties. Only set if page_type = SLIDE.
     },
   ],
   &quot;title&quot;: &quot;A String&quot;, # The title of the presentation.
@@ -6128,12 +7115,7 @@
       },
       &quot;pageType&quot;: &quot;A String&quot;, # The type of the page.
       &quot;revisionId&quot;: &quot;A String&quot;, # The revision ID of the presentation containing this page. Can be used in update requests to assert that the presentation revision hasn&#x27;t changed since the last read operation. Only populated if the user has edit access to the presentation. The format of the revision ID may change over time, so it should be treated opaquely. A returned revision ID is only guaranteed to be valid for 24 hours after it has been returned and cannot be shared across users. If the revision ID is unchanged between calls, then the presentation has not changed. Conversely, a changed ID (for the same presentation and user) usually means the presentation has been updated; however, a changed ID can also be due to internal factors such as ID format changes.
-      &quot;slideProperties&quot;: { # The properties of Page that are only relevant for pages with page_type SLIDE. # Slide specific properties. Only set if page_type = SLIDE.
-        &quot;isSkipped&quot;: True or False, # Whether the slide is skipped in the presentation mode. Defaults to false.
-        &quot;layoutObjectId&quot;: &quot;A String&quot;, # The object ID of the layout that this slide is based on. This property is read-only.
-        &quot;masterObjectId&quot;: &quot;A String&quot;, # The object ID of the master that this slide is based on. This property is read-only.
-        &quot;notesPage&quot;: # Object with schema name: Page # The notes page that this slide is associated with. It defines the visual appearance of a notes page when printing or exporting slides with speaker notes. A notes page inherits properties from the notes master. The placeholder shape with type BODY on the notes page contains the speaker notes for this slide. The ID of this shape is identified by the speakerNotesObjectId field. The notes page is read-only except for the text content and styles of the speaker notes shape. This property is read-only.
-      },
+      &quot;slideProperties&quot;: # Object with schema name: SlideProperties # Slide specific properties. Only set if page_type = SLIDE.
     },
   ],
   &quot;locale&quot;: &quot;A String&quot;, # The locale of the presentation, as an IETF BCP 47 language tag.
@@ -7144,12 +8126,7 @@
       },
       &quot;pageType&quot;: &quot;A String&quot;, # The type of the page.
       &quot;revisionId&quot;: &quot;A String&quot;, # The revision ID of the presentation containing this page. Can be used in update requests to assert that the presentation revision hasn&#x27;t changed since the last read operation. Only populated if the user has edit access to the presentation. The format of the revision ID may change over time, so it should be treated opaquely. A returned revision ID is only guaranteed to be valid for 24 hours after it has been returned and cannot be shared across users. If the revision ID is unchanged between calls, then the presentation has not changed. Conversely, a changed ID (for the same presentation and user) usually means the presentation has been updated; however, a changed ID can also be due to internal factors such as ID format changes.
-      &quot;slideProperties&quot;: { # The properties of Page that are only relevant for pages with page_type SLIDE. # Slide specific properties. Only set if page_type = SLIDE.
-        &quot;isSkipped&quot;: True or False, # Whether the slide is skipped in the presentation mode. Defaults to false.
-        &quot;layoutObjectId&quot;: &quot;A String&quot;, # The object ID of the layout that this slide is based on. This property is read-only.
-        &quot;masterObjectId&quot;: &quot;A String&quot;, # The object ID of the master that this slide is based on. This property is read-only.
-        &quot;notesPage&quot;: # Object with schema name: Page # The notes page that this slide is associated with. It defines the visual appearance of a notes page when printing or exporting slides with speaker notes. A notes page inherits properties from the notes master. The placeholder shape with type BODY on the notes page contains the speaker notes for this slide. The ID of this shape is identified by the speakerNotesObjectId field. The notes page is read-only except for the text content and styles of the speaker notes shape. This property is read-only.
-      },
+      &quot;slideProperties&quot;: # Object with schema name: SlideProperties # Slide specific properties. Only set if page_type = SLIDE.
     },
   ],
   &quot;notesMaster&quot;: { # A page in a presentation. # The notes master in the presentation. It serves three purposes: - Placeholder shapes on a notes master contain the default text styles and shape properties of all placeholder shapes on notes pages. Specifically, a `SLIDE_IMAGE` placeholder shape contains the slide thumbnail, and a `BODY` placeholder shape contains the speaker notes. - The notes master page properties define the common page properties inherited by all notes pages. - Any other shapes on the notes master appear on all notes pages. The notes master is read-only.
@@ -8158,12 +9135,7 @@
     },
     &quot;pageType&quot;: &quot;A String&quot;, # The type of the page.
     &quot;revisionId&quot;: &quot;A String&quot;, # The revision ID of the presentation containing this page. Can be used in update requests to assert that the presentation revision hasn&#x27;t changed since the last read operation. Only populated if the user has edit access to the presentation. The format of the revision ID may change over time, so it should be treated opaquely. A returned revision ID is only guaranteed to be valid for 24 hours after it has been returned and cannot be shared across users. If the revision ID is unchanged between calls, then the presentation has not changed. Conversely, a changed ID (for the same presentation and user) usually means the presentation has been updated; however, a changed ID can also be due to internal factors such as ID format changes.
-    &quot;slideProperties&quot;: { # The properties of Page that are only relevant for pages with page_type SLIDE. # Slide specific properties. Only set if page_type = SLIDE.
-      &quot;isSkipped&quot;: True or False, # Whether the slide is skipped in the presentation mode. Defaults to false.
-      &quot;layoutObjectId&quot;: &quot;A String&quot;, # The object ID of the layout that this slide is based on. This property is read-only.
-      &quot;masterObjectId&quot;: &quot;A String&quot;, # The object ID of the master that this slide is based on. This property is read-only.
-      &quot;notesPage&quot;: # Object with schema name: Page # The notes page that this slide is associated with. It defines the visual appearance of a notes page when printing or exporting slides with speaker notes. A notes page inherits properties from the notes master. The placeholder shape with type BODY on the notes page contains the speaker notes for this slide. The ID of this shape is identified by the speakerNotesObjectId field. The notes page is read-only except for the text content and styles of the speaker notes shape. This property is read-only.
-    },
+    &quot;slideProperties&quot;: # Object with schema name: SlideProperties # Slide specific properties. Only set if page_type = SLIDE.
   },
   &quot;pageSize&quot;: { # A width and height. # The size of pages in the presentation.
     &quot;height&quot;: { # A magnitude in a single direction in the specified units. # The height of the object.
@@ -9184,12 +10156,7 @@
       },
       &quot;pageType&quot;: &quot;A String&quot;, # The type of the page.
       &quot;revisionId&quot;: &quot;A String&quot;, # The revision ID of the presentation containing this page. Can be used in update requests to assert that the presentation revision hasn&#x27;t changed since the last read operation. Only populated if the user has edit access to the presentation. The format of the revision ID may change over time, so it should be treated opaquely. A returned revision ID is only guaranteed to be valid for 24 hours after it has been returned and cannot be shared across users. If the revision ID is unchanged between calls, then the presentation has not changed. Conversely, a changed ID (for the same presentation and user) usually means the presentation has been updated; however, a changed ID can also be due to internal factors such as ID format changes.
-      &quot;slideProperties&quot;: { # The properties of Page that are only relevant for pages with page_type SLIDE. # Slide specific properties. Only set if page_type = SLIDE.
-        &quot;isSkipped&quot;: True or False, # Whether the slide is skipped in the presentation mode. Defaults to false.
-        &quot;layoutObjectId&quot;: &quot;A String&quot;, # The object ID of the layout that this slide is based on. This property is read-only.
-        &quot;masterObjectId&quot;: &quot;A String&quot;, # The object ID of the master that this slide is based on. This property is read-only.
-        &quot;notesPage&quot;: # Object with schema name: Page # The notes page that this slide is associated with. It defines the visual appearance of a notes page when printing or exporting slides with speaker notes. A notes page inherits properties from the notes master. The placeholder shape with type BODY on the notes page contains the speaker notes for this slide. The ID of this shape is identified by the speakerNotesObjectId field. The notes page is read-only except for the text content and styles of the speaker notes shape. This property is read-only.
-      },
+      &quot;slideProperties&quot;: # Object with schema name: SlideProperties # Slide specific properties. Only set if page_type = SLIDE.
     },
   ],
   &quot;title&quot;: &quot;A String&quot;, # The title of the presentation.
@@ -10218,12 +11185,7 @@
       },
       &quot;pageType&quot;: &quot;A String&quot;, # The type of the page.
       &quot;revisionId&quot;: &quot;A String&quot;, # The revision ID of the presentation containing this page. Can be used in update requests to assert that the presentation revision hasn&#x27;t changed since the last read operation. Only populated if the user has edit access to the presentation. The format of the revision ID may change over time, so it should be treated opaquely. A returned revision ID is only guaranteed to be valid for 24 hours after it has been returned and cannot be shared across users. If the revision ID is unchanged between calls, then the presentation has not changed. Conversely, a changed ID (for the same presentation and user) usually means the presentation has been updated; however, a changed ID can also be due to internal factors such as ID format changes.
-      &quot;slideProperties&quot;: { # The properties of Page that are only relevant for pages with page_type SLIDE. # Slide specific properties. Only set if page_type = SLIDE.
-        &quot;isSkipped&quot;: True or False, # Whether the slide is skipped in the presentation mode. Defaults to false.
-        &quot;layoutObjectId&quot;: &quot;A String&quot;, # The object ID of the layout that this slide is based on. This property is read-only.
-        &quot;masterObjectId&quot;: &quot;A String&quot;, # The object ID of the master that this slide is based on. This property is read-only.
-        &quot;notesPage&quot;: # Object with schema name: Page # The notes page that this slide is associated with. It defines the visual appearance of a notes page when printing or exporting slides with speaker notes. A notes page inherits properties from the notes master. The placeholder shape with type BODY on the notes page contains the speaker notes for this slide. The ID of this shape is identified by the speakerNotesObjectId field. The notes page is read-only except for the text content and styles of the speaker notes shape. This property is read-only.
-      },
+      &quot;slideProperties&quot;: # Object with schema name: SlideProperties # Slide specific properties. Only set if page_type = SLIDE.
     },
   ],
   &quot;locale&quot;: &quot;A String&quot;, # The locale of the presentation, as an IETF BCP 47 language tag.
@@ -11234,12 +12196,7 @@
       },
       &quot;pageType&quot;: &quot;A String&quot;, # The type of the page.
       &quot;revisionId&quot;: &quot;A String&quot;, # The revision ID of the presentation containing this page. Can be used in update requests to assert that the presentation revision hasn&#x27;t changed since the last read operation. Only populated if the user has edit access to the presentation. The format of the revision ID may change over time, so it should be treated opaquely. A returned revision ID is only guaranteed to be valid for 24 hours after it has been returned and cannot be shared across users. If the revision ID is unchanged between calls, then the presentation has not changed. Conversely, a changed ID (for the same presentation and user) usually means the presentation has been updated; however, a changed ID can also be due to internal factors such as ID format changes.
-      &quot;slideProperties&quot;: { # The properties of Page that are only relevant for pages with page_type SLIDE. # Slide specific properties. Only set if page_type = SLIDE.
-        &quot;isSkipped&quot;: True or False, # Whether the slide is skipped in the presentation mode. Defaults to false.
-        &quot;layoutObjectId&quot;: &quot;A String&quot;, # The object ID of the layout that this slide is based on. This property is read-only.
-        &quot;masterObjectId&quot;: &quot;A String&quot;, # The object ID of the master that this slide is based on. This property is read-only.
-        &quot;notesPage&quot;: # Object with schema name: Page # The notes page that this slide is associated with. It defines the visual appearance of a notes page when printing or exporting slides with speaker notes. A notes page inherits properties from the notes master. The placeholder shape with type BODY on the notes page contains the speaker notes for this slide. The ID of this shape is identified by the speakerNotesObjectId field. The notes page is read-only except for the text content and styles of the speaker notes shape. This property is read-only.
-      },
+      &quot;slideProperties&quot;: # Object with schema name: SlideProperties # Slide specific properties. Only set if page_type = SLIDE.
     },
   ],
   &quot;notesMaster&quot;: { # A page in a presentation. # The notes master in the presentation. It serves three purposes: - Placeholder shapes on a notes master contain the default text styles and shape properties of all placeholder shapes on notes pages. Specifically, a `SLIDE_IMAGE` placeholder shape contains the slide thumbnail, and a `BODY` placeholder shape contains the speaker notes. - The notes master page properties define the common page properties inherited by all notes pages. - Any other shapes on the notes master appear on all notes pages. The notes master is read-only.
@@ -12248,12 +13205,7 @@
     },
     &quot;pageType&quot;: &quot;A String&quot;, # The type of the page.
     &quot;revisionId&quot;: &quot;A String&quot;, # The revision ID of the presentation containing this page. Can be used in update requests to assert that the presentation revision hasn&#x27;t changed since the last read operation. Only populated if the user has edit access to the presentation. The format of the revision ID may change over time, so it should be treated opaquely. A returned revision ID is only guaranteed to be valid for 24 hours after it has been returned and cannot be shared across users. If the revision ID is unchanged between calls, then the presentation has not changed. Conversely, a changed ID (for the same presentation and user) usually means the presentation has been updated; however, a changed ID can also be due to internal factors such as ID format changes.
-    &quot;slideProperties&quot;: { # The properties of Page that are only relevant for pages with page_type SLIDE. # Slide specific properties. Only set if page_type = SLIDE.
-      &quot;isSkipped&quot;: True or False, # Whether the slide is skipped in the presentation mode. Defaults to false.
-      &quot;layoutObjectId&quot;: &quot;A String&quot;, # The object ID of the layout that this slide is based on. This property is read-only.
-      &quot;masterObjectId&quot;: &quot;A String&quot;, # The object ID of the master that this slide is based on. This property is read-only.
-      &quot;notesPage&quot;: # Object with schema name: Page # The notes page that this slide is associated with. It defines the visual appearance of a notes page when printing or exporting slides with speaker notes. A notes page inherits properties from the notes master. The placeholder shape with type BODY on the notes page contains the speaker notes for this slide. The ID of this shape is identified by the speakerNotesObjectId field. The notes page is read-only except for the text content and styles of the speaker notes shape. This property is read-only.
-    },
+    &quot;slideProperties&quot;: # Object with schema name: SlideProperties # Slide specific properties. Only set if page_type = SLIDE.
   },
   &quot;pageSize&quot;: { # A width and height. # The size of pages in the presentation.
     &quot;height&quot;: { # A magnitude in a single direction in the specified units. # The height of the object.
@@ -13274,12 +14226,7 @@
       },
       &quot;pageType&quot;: &quot;A String&quot;, # The type of the page.
       &quot;revisionId&quot;: &quot;A String&quot;, # The revision ID of the presentation containing this page. Can be used in update requests to assert that the presentation revision hasn&#x27;t changed since the last read operation. Only populated if the user has edit access to the presentation. The format of the revision ID may change over time, so it should be treated opaquely. A returned revision ID is only guaranteed to be valid for 24 hours after it has been returned and cannot be shared across users. If the revision ID is unchanged between calls, then the presentation has not changed. Conversely, a changed ID (for the same presentation and user) usually means the presentation has been updated; however, a changed ID can also be due to internal factors such as ID format changes.
-      &quot;slideProperties&quot;: { # The properties of Page that are only relevant for pages with page_type SLIDE. # Slide specific properties. Only set if page_type = SLIDE.
-        &quot;isSkipped&quot;: True or False, # Whether the slide is skipped in the presentation mode. Defaults to false.
-        &quot;layoutObjectId&quot;: &quot;A String&quot;, # The object ID of the layout that this slide is based on. This property is read-only.
-        &quot;masterObjectId&quot;: &quot;A String&quot;, # The object ID of the master that this slide is based on. This property is read-only.
-        &quot;notesPage&quot;: # Object with schema name: Page # The notes page that this slide is associated with. It defines the visual appearance of a notes page when printing or exporting slides with speaker notes. A notes page inherits properties from the notes master. The placeholder shape with type BODY on the notes page contains the speaker notes for this slide. The ID of this shape is identified by the speakerNotesObjectId field. The notes page is read-only except for the text content and styles of the speaker notes shape. This property is read-only.
-      },
+      &quot;slideProperties&quot;: # Object with schema name: SlideProperties # Slide specific properties. Only set if page_type = SLIDE.
     },
   ],
   &quot;title&quot;: &quot;A String&quot;, # The title of the presentation.
diff --git a/docs/dyn/slides_v1.presentations.pages.html b/docs/dyn/slides_v1.presentations.pages.html
index aab9b5e..68f1bda 100644
--- a/docs/dyn/slides_v1.presentations.pages.html
+++ b/docs/dyn/slides_v1.presentations.pages.html
@@ -1110,12 +1110,7 @@
   },
   &quot;pageType&quot;: &quot;A String&quot;, # The type of the page.
   &quot;revisionId&quot;: &quot;A String&quot;, # The revision ID of the presentation containing this page. Can be used in update requests to assert that the presentation revision hasn&#x27;t changed since the last read operation. Only populated if the user has edit access to the presentation. The format of the revision ID may change over time, so it should be treated opaquely. A returned revision ID is only guaranteed to be valid for 24 hours after it has been returned and cannot be shared across users. If the revision ID is unchanged between calls, then the presentation has not changed. Conversely, a changed ID (for the same presentation and user) usually means the presentation has been updated; however, a changed ID can also be due to internal factors such as ID format changes.
-  &quot;slideProperties&quot;: { # The properties of Page that are only relevant for pages with page_type SLIDE. # Slide specific properties. Only set if page_type = SLIDE.
-    &quot;isSkipped&quot;: True or False, # Whether the slide is skipped in the presentation mode. Defaults to false.
-    &quot;layoutObjectId&quot;: &quot;A String&quot;, # The object ID of the layout that this slide is based on. This property is read-only.
-    &quot;masterObjectId&quot;: &quot;A String&quot;, # The object ID of the master that this slide is based on. This property is read-only.
-    &quot;notesPage&quot;: # Object with schema name: Page # The notes page that this slide is associated with. It defines the visual appearance of a notes page when printing or exporting slides with speaker notes. A notes page inherits properties from the notes master. The placeholder shape with type BODY on the notes page contains the speaker notes for this slide. The ID of this shape is identified by the speakerNotesObjectId field. The notes page is read-only except for the text content and styles of the speaker notes shape. This property is read-only.
-  },
+  &quot;slideProperties&quot;: # Object with schema name: SlideProperties # Slide specific properties. Only set if page_type = SLIDE.
 }</pre>
 </div>
 
diff --git a/docs/dyn/sourcerepo_v1.projects.repos.html b/docs/dyn/sourcerepo_v1.projects.repos.html
index d00bd4b..604d896 100644
--- a/docs/dyn/sourcerepo_v1.projects.repos.html
+++ b/docs/dyn/sourcerepo_v1.projects.repos.html
@@ -233,7 +233,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
@@ -387,7 +387,7 @@
     The object takes the form of:
 
 { # Request message for `SetIamPolicy` method.
-  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
+  &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
     &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
       { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
         &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
@@ -429,7 +429,7 @@
 Returns:
   An object of the form:
 
-    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) - etag: BwWWja0YfJA= - version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
+    { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { &quot;bindings&quot;: [ { &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;, &quot;members&quot;: [ &quot;user:mike@example.com&quot;, &quot;group:admins@example.com&quot;, &quot;domain:google.com&quot;, &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot; ] }, { &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;, &quot;members&quot;: [ &quot;user:eve@example.com&quot; ], &quot;condition&quot;: { &quot;title&quot;: &quot;expirable access&quot;, &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;, &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;, } } ], &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;, &quot;version&quot;: 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;) etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/).
   &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
     { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { &quot;audit_configs&quot;: [ { &quot;service&quot;: &quot;allServices&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot;, &quot;exempted_members&quot;: [ &quot;user:jose@example.com&quot; ] }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot; }, { &quot;log_type&quot;: &quot;ADMIN_READ&quot; } ] }, { &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;, &quot;audit_log_configs&quot;: [ { &quot;log_type&quot;: &quot;DATA_READ&quot; }, { &quot;log_type&quot;: &quot;DATA_WRITE&quot;, &quot;exempted_members&quot;: [ &quot;user:aliya@example.com&quot; ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
       &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
diff --git a/docs/dyn/streetviewpublish_v1.photos.html b/docs/dyn/streetviewpublish_v1.photos.html
index e424299..872fa95 100644
--- a/docs/dyn/streetviewpublish_v1.photos.html
+++ b/docs/dyn/streetviewpublish_v1.photos.html
@@ -352,7 +352,7 @@
   <pre>Lists all the Photos that belong to the user. *Note:* Recently created photos that are still being indexed are not returned in the response.
 
 Args:
-  filter: string, Optional. The filter expression. For example: `placeId=ChIJj61dQgK6j4AR4GeTYWZsKWw`. The only filter supported at the moment is `placeId`.
+  filter: string, Optional. The filter expression. For example: `placeId=ChIJj61dQgK6j4AR4GeTYWZsKWw`. The filters supported at the moment are: `placeId`, `min_latitude`, `max_latitude`, `min_longitude`, and `max_longitude`.
   languageCode: string, The BCP-47 language code, such as &quot;en-US&quot; or &quot;sr-Latn&quot;. For more information, see http://www.unicode.org/reports/tr35/#Unicode_locale_identifier. If language_code is unspecified, the user&#x27;s language preference for Google services is used.
   pageSize: integer, The maximum number of photos to return. `pageSize` must be non-negative. If `pageSize` is zero or is not provided, the default page size of 100 is used. The number of photos returned in the response may be less than `pageSize` if the number of photos that belong to the user is less than `pageSize`.
   pageToken: string, The nextPageToken value returned from a previous ListPhotos request, if any.