---
schema_version: 1
route: /t/gcloud.md
tool: "gcloud"
---

# sincecutoff.com /t/gcloud — gcloud CLI

- name: gcloud CLI
- kind: cli
- children: none
- homepage: <https://cloud.google.com/sdk/gcloud>

Changes to the tools coding agents drive, since a model's training cutoff, each linked to its first-party source. Check installed versions and limitations before acting; a cutoff date does not establish what a model knows.
Original editorial content: [Apache 2.0](https://sincecutoff.com/v1/data-license.txt), by [0xPatrick](https://0xpatrick.dev). Preserve applicable license and [NOTICE](https://sincecutoff.com/notice.txt) attribution when redistributing. Third-party source text and examples retain their own rights. [License scope and attribution](https://sincecutoff.com/v1/license.json).
To stay current, read the changes feed: [`/v1/changes.md?tool=gcloud`](https://sincecutoff.com/v1/changes.md?tool=gcloud) (or `.json`), adding `since=YYYY-MM-DD` for your training cutoff. Entries for registered children are included; the registry itself is `/v1/tools.json`. How to page and save your place: [llms.txt](https://sincecutoff.com/llms.txt).

### bq transfer configs support Dataplex Entry Group integration and filtering (2026-10-13)
- slug: bq-transfer-configs-support-dataplex-entry-group-integration-and-filtering-f2cbb3665d70
- score: 0.97

How to use it:

When creating or updating a transfer config for Dataplex Entry Group integration, use `--dataplex_entry_group`; to list configs with Dataplex configuration metadata, filter with `--filter="metadata_destination.dataplex_configuration:*"`.

Examples:

```
bq mk --transfer_config --data_source=<DATA_SOURCE> --dataplex_entry_group=<ENTRY_GROUP>
```

```
bq update --transfer_config --dataplex_entry_group=<ENTRY_GROUP> <TRANSFER_CONFIG>
```

```
bq ls --transfer_config --transfer_location=<LOCATION> --project_id=<PROJECT_ID> --filter="metadata_destination.dataplex_configuration:*"
```

- why_it_matters: Create, update, or list transfer configs associated with Dataplex Entry Groups.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#58900_2026-10-13>, <https://docs.cloud.google.com/bigquery/docs/reference/bq-cli-reference?hl=en>
- gotchas: "--dataplex_entry_group: Release note says this flag enables Dataplex Entry Group integration for create and update; its value format and requiredness are not documented in the CLI reference."; "--data_source (required): Data source for the transfer configuration."; "--transfer_config (required): Selects transfer configuration creation, update, or listing, depending on the command."; "<TRANSFER_CONFIG> (required): Resource to update; the reference defines `RESOURCE` as the resource to update."; "--filter: Filters listed resources to match the supplied expression; the Dataplex metadata expression is specified by the release note."; "--transfer_location (required): Location of transfer configurations to list."; "--project_id (required): Project whose transfer configurations are listed."; "Prerequisite: Run `bq` in Cloud Shell or install and configure the Google Cloud CLI for local use."

### gcloud compute --metadata-from-file reads from standard input (2026-10-06)
- slug: gcloud-compute-metadata-from-file-reads-from-standard-input-ad55f902bd89
- score: 0.95

How to use it:

When metadata comes from standard input, pass `-` as the file path in `--metadata-from-file`. Use `KEY=-` on any of the four listed Compute commands.

Examples:

```
printf '%s' '<metadata-value>' | gcloud compute instances add-metadata <INSTANCE_NAME> --zone=<ZONE> --metadata-from-file=<KEY>=-
```

```
printf '%s' '<metadata-value>' | gcloud compute project-info add-metadata --metadata-from-file=<KEY>=-
```

```
gcloud compute instances create <INSTANCE_NAME> --metadata-from-file=<KEY>=- < <INPUT_SOURCE>
```

- why_it_matters: Set instance or project metadata from data produced on standard input.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#58800_2026-10-06>, <https://docs.cloud.google.com/sdk/gcloud/reference/compute/instances/add-metadata>, <https://docs.cloud.google.com/sdk/gcloud/reference/compute/project-info/add-metadata>, <https://docs.cloud.google.com/sdk/gcloud/reference/compute/instances/create>
- gotchas: "--metadata-from-file=KEY=LOCAL_FILE_PATH (required): Sets a metadata value from a local file; use `-` as the path to read the value from standard input. For the add-metadata commands, at least one of `--metadata` or `--metadata-from-file` is required."; "KEY (required): Metadata key paired with the input value."; "INSTANCE_NAME (required): Instance to create or update."; "--zone=ZONE: Instance zone; if omitted, gcloud may prompt or attempt to determine it from the active project."; "The `-` file path reads the metadata value from standard input."; "This applies to the four listed commands."

### gcloud privateca certificates create --key-algorithm (2026-10-06)
- slug: gcloud-privateca-certificates-create-key-algorithm-8a74fa97dc36
- score: 0.93

How to use it:

When creating a certificate with a generated key, set `--key-algorithm` to choose the client-side key algorithm. The documented values are `rsa-2048`, `rsa-3072`, `rsa-4096`, `ec-p256`, and `ec-p384`.

Examples:

```
gcloud privateca certificates create <certificate-id> --issuer-pool=<pool> --issuer-location=<location> --generate-key --key-output-file=<key.pem> --key-algorithm=ec-p256 --cert-output-file=<cert.pem> --dns-san=<domain> --use-preset-profile=leaf_server_tls
```

- why_it_matters: Create a certificate with a generated key using a custom public key algorithm.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#58800_2026-10-06>, <https://docs.cloud.google.com/sdk/gcloud/reference/privateca/certificates/create>
- gotchas: "--generate-key (required): Generate a new private key on the client machine."; "--key-output-file (required): Path for the generated PEM private key."; "--key-algorithm: Algorithm for the client-side private key; defaults to `rsa-2048`. Allowed values: `rsa-2048`, `rsa-3072`, `rsa-4096`, `ec-p256`, `ec-p384`."; "--issuer-pool (required): Parent CA pool for the certificate."; "--issuer-location (required): Location of the certificate."; "--cert-output-file (required): Path to write the PEM-encoded certificate chain; the command requires this or `--validate-only`."; "--dns-san (required): One or more DNS Subject Alternative Names; the command requires at least one subject name option when describing the certificate."; "--use-preset-profile (required): Name of an existing preset X.509 profile; the command permits this or X.509 parameter flags."; "This applies when creating certificates with `--generate-key`."; "The supported key algorithm values are not stated."

### Cloud Tasks create commands accept task-level retry flags (2026-09-29)
- slug: cloud-tasks-create-commands-accept-task-level-retry-flags-f34accc9be69
- score: 0.96

How to use it:

When creating an HTTP or App Engine task with alpha or beta gcloud, pass the task-level retry flags to set that task’s retry behavior. For HTTP tasks, the documented flags are --max-attempts, --max-backoff, --max-doublings, --max-retry-duration, and --min-backoff; the App Engine reference does not document these flags.

Examples:

```
gcloud alpha tasks create-http-task --queue=<QUEUE> --url=<HTTP_URL> --max-attempts=<N> --max-retry-duration=<DURATION> --min-backoff=<DURATION> --max-backoff=<DURATION> --max-doublings=<N>
```

```
gcloud alpha tasks create-app-engine-task --queue=<QUEUE> --url=<RELATIVE_URL> <TASK_ID>
```

- why_it_matters: Override queue-level retry settings for an individual HTTP or App Engine task.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#58700_2026-09-29>, <https://docs.cloud.google.com/sdk/gcloud/reference/alpha/tasks/create-http-task>, <https://docs.cloud.google.com/sdk/gcloud/reference/alpha/tasks/create-app-engine-task>
- gotchas: "Availability: alpha, beta"; "--queue=<QUEUE> (required): Queue the task belongs to."; "--url=<HTTP_URL> (required): Full target URL; must begin with http:// or https://."; "--max-attempts=<N>: Maximum attempts; 1 means no retries and -1 means unlimited."; "--max-retry-duration=<DURATION>: Maximum time window for retrying a failed task; example 3600s."; "--min-backoff=<DURATION>: Minimum wait before retrying; example 10s."; "--max-backoff=<DURATION>: Maximum wait before retrying; example 300s."; "--max-doublings=<N>: Maximum number of times the backoff period will double."; "--queue=<QUEUE> (required): Queue the App Engine task belongs to."; "--url=<RELATIVE_URL>: Relative request URL; must begin with /; defaults to /."; "<TASK_ID>: Optional task ID; omitted IDs are generated automatically."; "The flags override the queue-level retry configuration for an individual task."; "Docs conflict: The official App Engine task reference last updated 2026-05-27 does not list any of the five task-level retry flags, despite the release note saying they were added on 2026-09-29. No conflicting behavior is asserted; App Engine usage and flag descriptions are therefore not documented in the sources found."

### gcloud alpha|beta tasks batch-create creates tasks from a file (2026-09-29)
- slug: gcloud-alpha-beta-tasks-batch-create-creates-tasks-from-a-file-53b03ebd7aa2
- score: 0.94

How to use it:

When you need to create multiple Cloud Tasks from a JSON or YAML file, run `gcloud alpha tasks batch-create` with the target queue and input file.

Examples:

```
gcloud alpha tasks batch-create --queue=<queue> --tasks-from-file=<tasks.yaml>
```

- why_it_matters: Create multiple Cloud Tasks from a JSON or YAML file in one batch operation.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#58700_2026-09-29>, <https://docs.cloud.google.com/sdk/gcloud/reference/alpha/tasks/batch-create>
- gotchas: "Availability: alpha, beta"; "--queue (required): Queue the tasks belong to."; "--tasks-from-file (required): Path to a JSON or YAML file listing tasks, or `-` to read from stdin."; "--dry-run: Validate task specifications without creating tasks."; "--failed-tasks-file: Path for writing a JSON record of failed tasks."; "--location: Location to manage the queue or task; defaults to the current project's App Engine app location, if associated."; "Prerequisite: The command is alpha; the docs say it may change without notice."; "The input file is JSON or YAML."

### gcloud alpha|beta tasks delete supports batch deletion from files (2026-09-29)
- slug: gcloud-alpha-beta-tasks-delete-supports-batch-deletion-from-files-54bcab5f11fb
- score: 0.92

How to use it:

When deleting multiple Cloud Tasks, pass the queue and task input file to `gcloud alpha` or `gcloud beta tasks delete`; optionally write failed or skipped tasks to an output file. The input file can list task IDs/names one per line or use JSON/YAML format.

Examples:

```
gcloud beta tasks delete --queue=<queue> --from-file=<tasks-file> --failed-tasks-file=<failed-tasks-file>
```

```
gcloud alpha tasks delete --queue=<queue> --from-file=<tasks-file> --failed-tasks-file=<failed-tasks-file>
```

- why_it_matters: Delete multiple Cloud Tasks in one batch operation using task input and failed-task output files.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#58700_2026-09-29>, <https://docs.cloud.google.com/sdk/gcloud/reference/beta/tasks/delete>
- gotchas: "Availability: alpha, beta"; "--queue=<queue> (required): Queue the tasks belong to."; "--from-file=<tasks-file>: Path to a file containing task IDs/names to delete, one per line or in JSON/YAML format."; "--failed-tasks-file=<failed-tasks-file>: Path to a file for JSON details of tasks that failed or were skipped during batch deletion."; "Docs conflict: The alpha command reference, last updated 2026-05-27, documents only single-task deletion and omits both file flags; the beta command reference, last updated 2026-09-29, documents batch deletion and both flags. https://docs.cloud.google.com/sdk/gcloud/reference/alpha/tasks/delete"

### gcloud compute instances bulk create accepts instance flexibility and min CPU platform settings (2026-09-29)
- slug: gcloud-compute-instances-bulk-create-accepts-instance-flexibility-and-min-cpu-pl-95221805dc77
- score: 0.90

How to use it:

To create bulk Compute Engine instances with selected machine types and a minimum CPU platform, use the beta bulk-create command with `--instance-selection` or `--instance-flexibility-policy`.

Examples:

```
gcloud beta compute instances bulk create --name-pattern=<name-pattern> --count=<count> --region=<region> --instance-selection="name=<selection-name>,machine-type=<machine-type>,min-cpu-platform=<platform>"
```

```
gcloud beta compute instances bulk create --name-pattern=<name-pattern> --count=<count> --region=<region> --instance-flexibility-policy='{"instanceSelections":{"<selection-name>":{"rank":<rank>,"machineTypes":["<machine-type>"],"minCpuPlatform":"<platform>"}}}'
```

- why_it_matters: Specify instance flexibility and a minimum CPU platform when bulk creating Compute Engine instances.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#58700_2026-09-29>, <https://docs.cloud.google.com/sdk/gcloud/reference/compute/instances/bulk/create>
- gotchas: "Availability: beta"; "--name-pattern (required): Pattern for instance names; alternatively provide `--predefined-names`."; "--count: Number of instances to create; when omitted with predefined names, uses the number of names provided."; "--region (required): Region for bulk creation; alternatively specify `--zone`."; "--instance-selection: Named machine-type selection; repeat the flag for each selection. This form supports minimum CPU platform overrides but not disks."; "name (required): Name for the selection."; "machine-type (required): Machine type in the selection; the flag syntax allows repeated machine-type values."; "rank: Optional rank for the named selection."; "min-cpu-platform: Minimum CPU platform override for the selection."; "--instance-flexibility-policy: JSON policy containing named selections; may specify additional overrides such as minimum CPU platform and disks. Mutually exclusive with `--instance-selection` and `--instance-selection-machine-types`."; "instanceSelections (required): Object mapping selection names to selection configurations."; "rank: Optional selection rank in the flexibility policy."; "machineTypes (required): Array of machine types for the selection."; "minCpuPlatform: Minimum CPU platform for the selection."; "disks: Disk overrides for the selection; the docs example uses entries with `deviceName` and `boot`."; "deviceName: Disk device name in the documented flexibility-policy example."; "boot: Whether the documented policy disk is a boot disk."

### gcloud dataproc cluster commands accept --multizone (2026-09-29)
- slug: gcloud-dataproc-cluster-commands-accept-multizone-95c80c04707d
- score: 0.95

How to use it:

When creating a Dataproc cluster in a region with instances allowed across multiple zones, run `gcloud dataproc clusters create <cluster> --region=<region> --multizone`. For a workflow template’s managed cluster, run `gcloud dataproc workflow-templates set-managed-cluster <template> --region=<region> --multizone`.

Examples:

```
gcloud dataproc clusters create <cluster> --region=<region> --multizone
```

```
gcloud dataproc workflow-templates set-managed-cluster <template> --region=<region> --multizone
```

- why_it_matters: Create a Dataproc cluster with instances distributed across zones in a region.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#58700_2026-09-29>, <https://docs.cloud.google.com/sdk/gcloud/reference/dataproc/clusters/create>, <https://docs.cloud.google.com/sdk/gcloud/reference/dataproc/workflow-templates/set-managed-cluster>
- gotchas: "<cluster> (required): Cluster ID or fully qualified cluster identifier."; "--region=<region> (required): Dataproc region for the cluster; instances are constrained to Compute Engine zones in that region."; "--multizone: Create a multi-zonal cluster where instances can be created across multiple zones within the region."; "<template> (required): Workflow template ID or fully qualified template identifier."; "--region=<region> (required): Dataproc region for the template; instances are constrained to Compute Engine zones in that region."; "--multizone: Create a multi-zonal cluster where instances can be created across multiple zones within the region."; "Instances can be created across multiple zones within the region."

### gcloud run instances deploy configures HTTP/2 (2026-09-29)
- slug: gcloud-run-instances-deploy-configures-http-2-09c574486216
- score: 0.95

How to use it:

To configure HTTP/2 for a Cloud Run instance, deploy it with `--use-http2` to enable HTTP/2 or `--no-use-http2` to disable it.

Examples:

```
gcloud alpha run instances deploy <INSTANCE> --image=<IMAGE> --use-http2
```

```
gcloud alpha run instances deploy <INSTANCE> --image=<IMAGE> --no-use-http2
```

- why_it_matters: Configure whether a deployed Cloud Run instance uses HTTP/2 connections.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#58700_2026-09-29>, <https://docs.cloud.google.com/sdk/gcloud/reference/alpha/run/instances/deploy>
- gotchas: "INSTANCE: Instance ID or fully qualified instance identifier."; "--image: Container image to deploy."; "--use-http2: Enable HTTP/2 connections to the instance."; "--no-use-http2: Disable HTTP/2 connections to the instance. The two flag forms are mutually exclusive."; "Prerequisite: The documented command is `gcloud alpha run instances deploy`; the reference labels it alpha and notes it may change without notice."

### gcloud vector-search data-object search accepts dense recall targets (2026-09-29)
- slug: gcloud-vector-search-data-object-search-accepts-dense-recall-targets-c80a44d9ed9c
- score: 0.93

How to use it:

For a dense vector search that needs a query-time recall target, pass `--dense-scann-target-recall=<value>` to the search command; the value must be between 0 and 1 inclusive.

Examples:

```
gcloud vector-search collections data-objects search --project=<PROJECT_ID> --location=<LOCATION> --collection=<COLLECTION_ID> --vector-search-field=plot_embedding --vector-from-file=<SEARCH_VECTOR_FILE> --use-index=<INDEX_ID> --dense-scann-target-recall=0.95 --top-k=10
```

- why_it_matters: Set a query-time target recall for dense index search.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#58700_2026-09-29>, <https://docs.cloud.google.com/gemini-enterprise-agent-platform/build/vector-search-2/query-search/search>, <https://docs.cloud.google.com/sdk/gcloud/reference/vector-search/collections/data-objects/search>
- gotchas: "--dense-scann-target-recall=<TARGET_RECALL>: Query-time target recall for dense ScaNN search; value is in [0, 1]. Cannot be combined with `--dense-scann-search-leaves-pct` or `--dense-scann-initial-candidate-count`."; "--collection=<COLLECTION> (required): Collection to search data objects from."; "--location=<LOCATION> (required): Location of the collection."; "--vector-search-field=<VECTOR_SEARCH_FIELD> (required): Vector field to search; required for vector search."; "--vector-from-file=<VECTOR_FROM_FILE> (required): Path to a JSON file containing the dense or sparse search vector; required for vector search."; "--use-index=<INDEX>: Index resource name or ID to use for the search."; "--top-k=<TOP_K>: Number of nearest neighbors to return; defaults to 10."; "Prerequisite: Initialize the Google Cloud CLI with authentication and a project, using `gcloud init` or `gcloud auth login` and `gcloud config set project`."; "The value must be in `[0, 1]`."; "The target recall applies to dense index search at query time."

### gcloud beta network-connectivity transports create adds flags and makes --network optional (2026-09-22)
- slug: gcloud-beta-network-connectivity-transports-create-adds-flags-and-makes-network-07995c8df986
- announced: 2026-03-31
- status: ga
- score: 0.90

How to use it:

When creating a transport attached to an NCC hub, use `--hub` and optionally `--auto-accept` and `--psc-routing-enabled`; `--network` is optional in the current reference. Provide either an activation key or the bandwidth, remote account ID, and remote profile required to generate one.

Examples:

```
gcloud beta network-connectivity transports create <transport> --bandwidth <bandwidth> --remote-account-id <remote-account-id> --remote-profile <remote-profile> --hub <hub> --auto-accept --psc-routing-enabled
```

- why_it_matters: Create a network connectivity transport with the required acceptance, hub, or PSC routing options.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#56300_2026-03-31>, <https://docs.cloud.google.com/sdk/gcloud/reference/beta/network-connectivity/transports/create>, <https://docs.cloud.google.com/sdk/docs/release-notes#58600_2026-09-22>
- gotchas: "TRANSPORT (required): Transport ID or fully qualified identifier."; "--activation-key (required): Use this or the key-generation arguments; the reference requires exactly one of these alternatives."; "--bandwidth (required): For key generation, provide with `--remote-account-id` and `--remote-profile`; must be supported by the remote profile."; "--remote-account-id (required): For key generation, account ID at the remote provider; required with the other key-generation arguments."; "--remote-profile (required): For key generation, remote transport profile; required with the other key-generation arguments."; "--network: VPC network to peer with the provider; the hub option is an alternative to this network option."; "--hub: Hub to attach the transport to; used in the NCC hub option instead of `--network`."; "--auto-accept: Whether to auto-accept spoke proposals for this transport."; "--psc-routing-enabled: Whether to create a VPC spoke for PSC routing over the transport."; "The `--network` flag is optional."; "Docs conflict: The current reference, last updated 2026-06-16, lists `--network` and the `--hub` option as mutually exclusive alternatives; this conflicts with the card's statement that `--network` is optional. The reference does not say that both may be omitted."; "Availability: generally available since 2026-09-22"

### gcloud api-gateway gateways create adds response streaming mode (2026-09-15)
- slug: gcloud-api-gateway-gateways-create-adds-response-streaming-mode-54292e56cad7
- score: 0.97

How to use it:

When creating an API Gateway for streaming responses, run `gcloud api-gateway gateways create` with `--enable-streaming`; the mode is fixed at creation.

Examples:

```
gcloud api-gateway gateways create <GATEWAY_ID> --api=<API_ID> --api-config=<CONFIG_ID> --location=<GCP_REGION> --enable-streaming
```

- why_it_matters: Create an API Gateway that streams responses for a service using server-sent events, chunked HTTP, WebSockets, or bidirectional gRPC/HTTP2.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#58500_2026-09-15>, <https://docs.cloud.google.com/api-gateway/docs/streaming-configure>, <https://docs.cloud.google.com/sdk/gcloud/reference/api-gateway/gateways/create>, <https://docs.cloud.google.com/api-gateway/docs/deploying-api>
- gotchas: "GATEWAY_ID (required): Gateway ID or fully qualified gateway identifier."; "--location (required): Cloud location for the gateway."; "--api-config (required): API config ID or fully qualified identifier for the config the gateway will use."; "--api: API ID; may be specified with `--api-config`."; "--enable-streaming: Create the gateway with streaming enabled; this setting cannot be changed after creation."; "Prerequisite: If `--enable-streaming` is unrecognized, update the gcloud component installation with `gcloud components update`."; "Streaming mode can only be set when the gateway is created."; "Streaming response protocols listed are server-sent events, HTTP chunked transfer, WebSockets, and gRPC/HTTP2 bidirectional streaming."

### gcloud beta compute url-maps invalidate-cdn-cache adds extended matchers (2026-09-15)
- slug: gcloud-beta-compute-url-maps-invalidate-cdn-cache-adds-extended-matchers-4a75f7c37607
- score: 0.95

How to use it:

To invalidate Cloud CDN cache entries matching extended criteria, run the beta command for a URL map with the documented match flags. For wildcard host matching, set `--host="*.example.com"`; the current command reference does not document the new matcher flags or wildcard behavior.

Examples:

```
gcloud beta compute url-maps invalidate-cdn-cache <URL_MAP> --host="*.example.com" --path="<PATH>"
```

- why_it_matters: Invalidate CDN cache entries using extended matchers, including a wildcard host match.
- before: The documented command used the URL map with `--host` and `--path` selectors; it did not list the extended matcher flags.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#58500_2026-09-15>, <https://docs.cloud.google.com/sdk/gcloud/reference/beta/compute/url-maps/invalidate-cdn-cache>, <https://docs.cloud.google.com/cdn/docs/invalidating-cached-content>
- gotchas: "Availability: Beta track."; "URL_MAP (required): Name of the URL map to operate on."; "--path (required): Selects objects by URL path; path must start with `/`."; "--host: Limits invalidation to requests for the specified host. The release note says `*` wildcard matching is supported."; "--content-type: Added for extended invalidation matching; accepted values and detailed behavior are not documented in the current command reference."; "--http-status: Added for extended invalidation matching; accepted values and detailed behavior are not documented in the current command reference."; "--backend-bucket: Added for extended invalidation matching; accepted values and detailed behavior are not documented in the current command reference."; "--backend-service: Added for extended invalidation matching; accepted values and detailed behavior are not documented in the current command reference."; "Prerequisite: The command is beta and may change without notice."; "Prerequisite: Required IAM permissions: `compute.urlMaps.get`, `compute.urlMaps.invalidateCache`, and `compute.urlMaps.list`; documented roles include `roles/compute.networkAdmin` and `roles/compute.loadBalancerAdmin`."; "Wildcard matching is supported in the `--host` flag."; "Docs conflict: The current beta command reference, last updated 2026-05-27, does not list `--content-type`, `--http-status`, `--backend-bucket`, or `--backend-service`; the release note dated 2026-09-15 says these flags were added. The reference predates the change, so it does not establish post-change syntax or behavior."; "Docs conflict: The current beta command reference says a `*` in `--path` is allowed only at the end following `/`; the card's wildcard applies to `--host`, per the release note."

### gcloud transfer jobs create/update accepts storage class inclusion flags (2026-09-15)
- slug: gcloud-transfer-jobs-create-update-accepts-storage-class-inclusion-flags-cfc0398333e9
- score: 0.93

How to use it:

For a transfer job sourced from Amazon S3, set `--include-storage-classes` to the classes to transfer; use `gcloud transfer jobs update <job-name> --clear-include-storage-classes` to remove the filter.

Examples:

```
gcloud transfer jobs create s3://<source-bucket> gs://<destination-bucket> --include-storage-classes=STANDARD,GLACIER
```

```
gcloud transfer jobs update <job-name> --include-storage-classes=STANDARD,GLACIER
```

```
gcloud transfer jobs update <job-name> --clear-include-storage-classes
```

- why_it_matters: Configure a transfer job to include selected storage classes.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#58500_2026-09-15>, <https://docs.cloud.google.com/sdk/gcloud/reference/transfer/jobs/create>, <https://docs.cloud.google.com/sdk/gcloud/reference/transfer/jobs/update>, <https://docs.cloud.google.com/storage-transfer/docs/filtering-by-storage-class>
- gotchas: "SOURCE (required): Source location; use `s3://<bucket>` for an Amazon S3 source."; "DESTINATION (required): Destination location; Google Cloud Storage uses `gs://<bucket>`."; "NAME (required): Name of the transfer job to update."; "--include-storage-classes: Comma-separated Amazon S3 storage classes to include; objects in other classes are skipped. Example values: `STANDARD,GLACIER`."; "--clear-include-storage-classes: Removes the storage class filter from the object conditions."; "Prerequisite: Storage class filtering applies to transfers from Amazon S3. Valid values are Amazon S3 storage class names."; "Prerequisite: Restore S3 Glacier Deep Archive (`DEEP_ARCHIVE`) and Glacier Flexible Retrieval (`GLACIER`) objects before transferring them."; "Docs conflict: The Google filtering guide, last updated 2026-09-30, says storage class filtering is not supported in gcloud CLI. This conflicts with the release note and current gcloud create/update references, which document the flags; the conflicting guide statement is not used."

### Cloud Composer create supports development mode (2026-09-01)
- slug: cloud-composer-create-supports-development-mode-5836b5de3e00
- score: 0.94

How to use it:

When creating a Cloud Composer environment in development mode, run `gcloud beta composer environments create` with `--enable-development-mode`.

Examples:

```
gcloud beta composer environments create <environment> --location=<region> --enable-development-mode
```

- why_it_matters: Create a Cloud Composer environment in development mode.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#58300_2026-09-01>, <https://docs.cloud.google.com/sdk/gcloud/reference/beta/composer/environments/create>
- gotchas: "Availability: Beta track."; "ENVIRONMENT (required): Environment ID or fully qualified identifier."; "--location (required): Region where the environment runs or will be created."; "--enable-development-mode: Whether to build a development-mode environment."

### gcloud beta composer environments hibernate and resume (2026-09-01)
- slug: gcloud-beta-composer-environments-hibernate-and-resume-dd17cfc3bab6
- score: 0.94

How to use it:

When you need to suspend a Cloud Composer environment, run the hibernate command; run resume when you need the environment again.

Examples:

```
gcloud beta composer environments hibernate <ENVIRONMENT>
```

```
gcloud beta composer environments resume <ENVIRONMENT>
```

- why_it_matters: Hibernate a Cloud Composer environment and resume it when needed.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#58300_2026-09-01>, <https://docs.cloud.google.com/sdk/gcloud/reference/beta/composer/environments/hibernate>, <https://docs.cloud.google.com/sdk/gcloud/reference/beta/composer/environments/resume>
- gotchas: "Availability: Beta track."; "ENVIRONMENT (required): Environment ID or fully qualified identifier. The project must also be specified, by the identifier, --project, or core/project."; "--location=LOCATION: Region where the environment runs; provide it if not included in the fully qualified identifier or composer/location property."; "--async: Return immediately without waiting for the operation to complete."

### gcloud beta parametermanager parameters create accepts --tags (2026-08-20)
- slug: gcloud-beta-parametermanager-parameters-create-accepts-tags-f4121500f328
- score: 0.93

How to use it:

When creating a Parameter Manager parameter, bind tags in the same command with `--tags` as `<tag-key-namespaced-name>=<tag-value-short-name>` pairs.

Examples:

```
gcloud beta parametermanager parameters create <parameter> --location=<location> --tags='{"<tag-key-namespaced-name>":"<tag-value-short-name>"}'
```

- why_it_matters: Create a Parameter Manager parameter and bind tags during creation.
- before: The documented create example creates the parameter with `gcloud beta parametermanager parameters create <parameter> --location=<location>`; the release note states `--tags` was added on 2026-08-20.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#2026-08-20>, <https://docs.cloud.google.com/sdk/gcloud/reference/beta/parametermanager/parameters/create>, <https://docs.cloud.google.com/sdk/docs/release-notes>
- gotchas: "Availability: beta"; "<parameter> (required): Parameter ID or fully qualified parameter identifier."; "--location (required): Parameter location; required unless supplied in the fully qualified parameter identifier."; "--tags: Map of tag key namespaced names to tag value short names; accepts shorthand, JSON, or a YAML/JSON file."

### gcloud policy-troubleshoot error-info-id troubleshoots IAM access denials (2026-08-20)
- slug: gcloud-policy-troubleshoot-error-info-id-troubleshoots-iam-access-denials-2db3a8ae734c
- score: 0.97

How to use it:

When you have an IAM access denial’s error identifier, run `gcloud policy-troubleshoot error-info-id` with that identifier to troubleshoot the denial.

- why_it_matters: Investigate an IAM access denial when you have its error identifier.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#2026-08-20>

### gcloud services API keys update supports --append (2026-08-18)
- slug: gcloud-services-api-keys-update-supports-append-e8f8547d5eff
- score: 0.97

How to use it:

When adding application or API target restrictions while retaining existing restrictions, run `gcloud services api-keys update` with `--append` and the new restriction flags.

Examples:

```
gcloud services api-keys update projects/<project>/locations/global/keys/<key-id> --append --allowed-referrers="https://www.example.com/*" --api-target=service=<service>.googleapis.com
```

- why_it_matters: Add application or API target restrictions to an API key while preserving its existing restrictions.
- before: Update the key's restrictions by replacing its existing restrictions with the new application and API target restrictions.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#58100_2026-08-18>, <https://docs.cloud.google.com/sdk/gcloud/reference/services/api-keys/update>
- gotchas: "KEY (required): Key ID or fully qualified key identifier."; "--append: Merge new restrictions with the key’s current restrictions instead of replacing them."; "--api-target: Repeatable; specifies a service and optionally specific methods."; "--allowed-application: Repeatable; specifies an allowed application using `sha1_fingerprint` and `package_name`."; "--allowed-bundle-ids: Specifies allowed iOS app bundle IDs."; "--allowed-ips: Specifies caller IP addresses allowed to make API calls with the key."; "--allowed-referrers: Specifies regular expressions for referrer URLs allowed to make API calls with the key."; "Application restriction flags: `--allowed-application`, `--allowed-bundle-ids`, `--allowed-ips`, and `--allowed-referrers` are mutually exclusive."

### gcloud backup-dr backups restore disk supports individual disk restore (2026-08-11)
- slug: gcloud-backup-dr-backups-restore-disk-supports-individual-disk-restore-a6275629a2d6
- score: 0.96

How to use it:

For a Compute Engine instance backup, restore one disk with `gcloud backup-dr backups restore disk`, specifying the boot-disk selector or the source data disk’s device name.

Examples:

```
gcloud backup-dr backups restore disk <COMPUTE_INSTANCE_BACKUP_NAME> --name=<DISK_NAME> --target-project=<TARGET_PROJECT_NAME> [--source-instance-boot-disk | --source-instance-disk-device-name=<SOURCE_DISK_DEVICE_NAME>] [--target-zone=<TARGET_ZONE_NAME> | --target-region=<TARGET_REGION_NAME> --replica-zones=<ZONE_NAME>] [DISK_OVERRIDE_FLAGS...] [--async]
```

- why_it_matters: Restore an individual disk from a Compute Engine instance backup.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#58000_2026-08-11>, <https://docs.cloud.google.com/backup-disaster-recovery/docs/cloud-console/compute/disk-restore>, <https://docs.cloud.google.com/sdk/gcloud/reference/backup-dr/backups/restore/disk>
- gotchas: "COMPUTE_INSTANCE_BACKUP_NAME (required): Name of the Compute Engine instance backup to restore from."; "--name (required): Name of the restored disk."; "--target-project (required): Project where the disk is restored."; "--source-instance-boot-disk: Selects the source instance boot disk. The restore guide presents this and the device-name flag as alternatives."; "--source-instance-disk-device-name: Selects a source data disk by its device name. The restore guide presents this and the boot-disk flag as alternatives."; "--target-zone: Zone where a zonal disk is restored; mutually exclusive with --target-region."; "--target-region: Region where a regional disk is restored; mutually exclusive with --target-zone."; "--replica-zones: Replica zone for a regional disk restore."; "[--source-instance-boot-disk | --source-instance-disk-device-name=...]: The guide documents these selectors as alternatives; it does not explicitly state whether one is required."; "The source is a Compute Engine instance backup."; "Docs conflict: The gcloud restore-disk reference last updated 2026-05-27 does not list the two source-instance flags in its syntax; the restore guide and release note document them later."

### gcloud beta network-connectivity hubs support PSC export flags (2026-08-11)
- slug: gcloud-beta-network-connectivity-hubs-support-psc-export-flags-9f3979b392a7
- score: 0.93

How to use it:

When configuring a hub’s Private Service Connect exports, use the published-services/regional-Google-APIs flag, the global-Google-APIs flag, or both with `gcloud beta network-connectivity hubs create` or `update`.

Examples:

```
gcloud beta network-connectivity hubs create <HUB> --export-psc-published-services-and-regional-google-apis --export-psc-global-google-apis
```

```
gcloud beta network-connectivity hubs update <HUB> --export-psc-published-services-and-regional-google-apis --export-psc-global-google-apis
```

- why_it_matters: Configure which Private Service Connect services and Google APIs a hub exports.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#58000_2026-08-11>, <https://docs.cloud.google.com/sdk/gcloud/reference/beta/network-connectivity/hubs/create>, <https://docs.cloud.google.com/sdk/gcloud/reference/beta/network-connectivity/hubs/update>, <https://docs.cloud.google.com/network-connectivity/docs/network-connectivity-center/how-to/working-with-hubs-spokes?hl=en>
- gotchas: "Availability: beta"; "<HUB> (required): Hub ID or fully qualified hub identifier."; "--export-psc-published-services-and-regional-google-apis: Enable propagation of Private Service Connect endpoints for published services and regional Google APIs. On update, `--no-export-psc-published-services-and-regional-google-apis` disables it. On create, this flag may be specified with the global-APIs flag, but not with `--export-psc`."; "--export-psc-global-google-apis: Enable propagation of Private Service Connect endpoints for global Google APIs. On update, `--no-export-psc-global-google-apis` disables it. On create, this flag may be specified with the published-services/regional-APIs flag, but not with `--export-psc`."; "Hub create permission (required): The documented IAM permission for creating a hub is `networkconnectivity.hubs.create`."; "Hub update permission (required): The documented IAM permission for updating a hub is `networkconnectivity.hubs.update`."; "Network Connectivity API (required): Enable the Network Connectivity API before performing NCC tasks."; "Prerequisite: Enable the Network Connectivity API."; "Prerequisite: For create, have `networkconnectivity.hubs.create`; for update, have `networkconnectivity.hubs.update`."

### gcloud compute backend services accept --circuit-breakers-max-requests (2026-08-11)
- slug: gcloud-compute-backend-services-accept-circuit-breakers-max-requests-6fac18380890
- score: 0.96

How to use it:

When configuring a backend service’s circuit breaker, set `--circuit-breakers-max-requests` to the maximum parallel requests allowed across the backend service cluster; it defaults to 1024.

Examples:

```
gcloud compute backend-services create <BACKEND_SERVICE_NAME> --circuit-breakers-max-requests=<MAX_REQUESTS>
```

```
gcloud compute backend-services update <BACKEND_SERVICE_NAME> --circuit-breakers-max-requests=<MAX_REQUESTS>
```

- why_it_matters: Configure the maximum requests setting for backend service circuit breakers.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#58000_2026-08-11>, <https://docs.cloud.google.com/sdk/gcloud/reference/compute/backend-services/create>, <https://docs.cloud.google.com/sdk/gcloud/reference/compute/backend-services/update>
- gotchas: "BACKEND_SERVICE_NAME (required): Name of the backend service to create or update."; "--circuit-breakers-max-requests=<MAX_REQUESTS>: Maximum number of parallel requests that can be made to all instances in the backend service cluster; default is 1024."

### gcloud compute backend services accept --consistent-hash-minimum-ring-size (2026-08-11)
- slug: gcloud-compute-backend-services-accept-consistent-hash-minimum-ring-size-32fe37b0fbb3
- score: 0.93

How to use it:

When creating or updating a backend service, set `--consistent-hash-minimum-ring-size=<size>` to configure the hash ring’s minimum virtual-node count.

Examples:

```
gcloud compute backend-services create <BACKEND_SERVICE_NAME> --consistent-hash-minimum-ring-size=<SIZE>
```

```
gcloud compute backend-services update <BACKEND_SERVICE_NAME> --consistent-hash-minimum-ring-size=<SIZE>
```

- why_it_matters: Configure a backend service's consistent hashing ring size.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#58000_2026-08-11>, <https://docs.cloud.google.com/sdk/gcloud/reference/compute/backend-services/create>, <https://docs.cloud.google.com/sdk/gcloud/reference/compute/backend-services/update>, <https://docs.cloud.google.com/compute/docs/reference/rest/v1/backendServices/update>
- gotchas: "BACKEND_SERVICE_NAME (required): Name of the backend service."; "--consistent-hash-minimum-ring-size=<SIZE>: Minimum number of virtual nodes for the hash ring; defaults to 1024. Larger sizes give more granular load distributions. If the backend pool has more hosts than the ring size, each host gets one virtual node."

### gcloud dataflow jobs add pause and resume commands (2026-08-11)
- slug: gcloud-dataflow-jobs-add-pause-and-resume-commands-76ad24207290
- score: 0.97

How to use it:

When a Dataflow job is eligible to pause, use `gcloud dataflow jobs pause` with its job ID and region; to resume a paused job, use `gcloud dataflow jobs resume` with the same arguments.

Examples:

```
gcloud dataflow jobs pause <JOB_ID> --region=<REGION_ID>
```

```
gcloud dataflow jobs resume <JOB_ID> --region=<REGION_ID>
```

- why_it_matters: Pause or resume a Dataflow job during development or maintenance.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#58000_2026-08-11>, <https://docs.cloud.google.com/sdk/gcloud/reference/dataflow/jobs/pause>, <https://docs.cloud.google.com/sdk/gcloud/reference/dataflow/jobs/resume>, <https://docs.cloud.google.com/dataflow/docs/guides/pause-job>
- gotchas: "JOB_ID (required): Job ID to operate on; one or more job IDs are accepted."; "--region=REGION_ID: Regional endpoint for the job; defaults to `us-central1`."; "Prerequisite: The job must be a batch job that uses Dataflow Shuffle and was run with the `pause_on_failure` service option. Its temporary directory contents must remain available while paused."; "Prerequisite: To resume, the job must be paused, not pausing."

### gcloud privateca subordinates activate supports first-party activation (2026-08-11)
- slug: gcloud-privateca-subordinates-activate-supports-first-party-activation-d74e3bcbea1f
- score: 0.91

How to use it:

When a subordinate CA already exists and is awaiting activation, activate it with `gcloud privateca subordinates activate` and the issuer pool, location, and CA flags.

Examples:

```
gcloud privateca subordinates activate <subordinate-ca> --location=<subordinate-location> --pool=<subordinate-pool> --issuer-pool=<issuer-pool> --issuer-location=<issuer-location> --issuer-ca=<issuer-ca>
```

- why_it_matters: Activate a subordinate CA that already exists or needs first-party activation.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#58000_2026-08-11>, <https://docs.cloud.google.com/sdk/gcloud/reference/privateca/subordinates/activate>
- gotchas: "CERTIFICATE_AUTHORITY (required): ID or fully qualified identifier of the subordinate CA to activate."; "--location (required): Subordinate CA location; can be supplied through a fully qualified CA name or the `privateca/location` property."; "--pool (required): Parent CA pool of the subordinate CA; can be supplied through a fully qualified CA name."; "--issuer-pool (required): ID or fully qualified identifier of the issuing CA pool when using issuer flags."; "--issuer-location (required): Location of the issuing CA; can be supplied through a fully qualified issuer pool name or `privateca/location`."; "--issuer-ca: ID of the issuing CA. If omitted, an available enabled CA in the issuing pool is chosen."; "--pem-chain: File of PEM certificates from the current CA certificate through the root CA certificate. This is an alternative activation method to issuer flags; the docs specify exactly one of `--pem-chain` or issuer-based activation."; "Prerequisite: The subordinate CA must already be created and awaiting activation."; "The activation suggestion applies when create with issuer flags fails due to an already existing subordinate CA."

### Compute Engine service attachments accept --routing-mode in beta (2026-08-04)
- slug: compute-engine-service-attachments-accept-routing-mode-in-beta-8c874e2c565b
- score: 0.93

How to use it:

When creating or updating a Compute Engine service attachment in beta, set `--routing-mode` to `PACKET_INJECTION` or `STANDARD_ROUTING` to choose its tunneling routing mode.

Examples:

```
gcloud beta compute service-attachments create <NAME> --nat-subnets=<NAT_SUBNETS> --producer-forwarding-rule=<PRODUCER_FORWARDING_RULE> --routing-mode=<ROUTING_MODE>
```

```
gcloud beta compute service-attachments update <NAME> --routing-mode=<ROUTING_MODE>
```

- why_it_matters: Set a routing mode when creating or updating a Compute Engine service attachment.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#57900_2026-08-04>, <https://docs.cloud.google.com/sdk/gcloud/reference/beta/compute/service-attachments/create>, <https://docs.cloud.google.com/sdk/gcloud/reference/beta/compute/service-attachments/update>
- gotchas: "Availability: beta"; "create: NAME (required): Name of the service attachment to create."; "create: --nat-subnets (required): Producer-provided subnetworks to use for NAT."; "create: --producer-forwarding-rule / --target-service (required): Specify exactly one: the target forwarding rule, or the URL of the target service."; "update: NAME (required): Name of the service attachment to update."; "--routing-mode: Sets the tunneling routing mode. Allowed values: `PACKET_INJECTION` (traffic is reinjected into the consumer network) or `STANDARD_ROUTING` (de-encapsulated response traffic is returned to the client). The docs do not state these values are mutually exclusive; choose one value."; "create: --region: Region of the service attachment; omission may prompt for a region in interactive mode."; "update: --region: Region of the service attachment; omission may prompt for a region in interactive mode."; "Prerequisite: Use the beta command track. For creation, an existing producer forwarding rule or target service and NAT subnetworks are required."

### Firestore emulator start supports index requirement and index file flags (2026-08-04)
- slug: firestore-emulator-start-supports-index-requirement-and-index-file-flags-a8d56cd01918
- score: 0.93

How to use it:

When running the Firestore emulator in Datastore Mode and queries require composite indexes, start it with `--require-indexes` and specify the index file with `--index-file`.

Examples:

```
gcloud emulators firestore start --database-mode=datastore-mode --require-indexes --index-file=<path/to/firestore.indexes.yaml>
```

- why_it_matters: Start a Firestore emulator with indexes required and a specified index file.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#57900_2026-08-04>, <https://docs.cloud.google.com/sdk/gcloud/reference/emulators/firestore/start>
- gotchas: "--database-mode (required): Set to `datastore-mode` to use these index flags; valid values are `firestore-native` (default) and `datastore-mode`."; "--require-indexes (required): Require composite indexes in the index file for queries that need them. Supported only in Datastore Mode with `--index-file`."; "--index-file (required): Path to the index file. Supported only in Datastore Mode with `--require-indexes`."

### gcloud functions deploy accepts all-traffic for direct VPC egress (2026-08-04)
- slug: gcloud-functions-deploy-accepts-all-traffic-for-direct-vpc-egress-1613de113cd5
- score: 0.92

How to use it:

For a 2nd gen Cloud Function that should route all outbound traffic through its VPC, deploy with `--direct-vpc-egress=all-traffic` and configure a VPC network or subnet. [Google Cloud Direct VPC egress guide](https://docs.cloud.google.com/functions/docs/running/direct-vpc?hl=en)

Examples:

```
gcloud functions deploy <FUNCTION_NAME> --source . --runtime <RUNTIME> --trigger-http --region <REGION> --network=<NETWORK> --subnet=<SUBNET> --direct-vpc-egress=all-traffic
```

- why_it_matters: Deploy a Cloud Function with direct VPC egress configured for all traffic.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#57900_2026-08-04>, <https://docs.cloud.google.com/functions/docs/running/direct-vpc?hl=en>, <https://docs.cloud.google.com/sdk/gcloud/reference/functions/deploy>
- gotchas: "<FUNCTION_NAME> (required): Function name."; "--runtime (required): Runtime; required for a new function."; "--region (required): Region where the function is deployed."; "--source: Source location; `.` uses the current directory. The Direct VPC example includes it."; "--trigger-http: Configures an HTTP trigger. The Direct VPC deployment example includes it."; "--network: VPC network the function can send traffic to. Specify a network, a subnet, or both; when only a network is specified, the subnet uses the same name."; "--subnet: VPC subnetwork from which the function gets IPs. Specify a network, a subnet, or both."; "--direct-vpc-egress: Selects outbound traffic routed through Direct VPC egress. Allowed values in the command reference include `private-ranges-only`, `all`, and `all-traffic`; the card’s `all-traffic` value is the requested setting."; "Prerequisite: Direct VPC egress requires a 2nd gen function; it is unavailable for 1st gen. Enable the Cloud Functions API, install and initialize the Google Cloud CLI, and update it to version 558.0.0 or later."; "Prerequisite: A VPC network must exist. To authorize Direct VPC egress, the function service account needs `roles/run.invoker`; the Cloud Run service agent must also have VPC access, by its default role or the documented alternative permissions."; "Prerequisite: Direct VPC egress and Serverless VPC Access connectors cannot be used at the same time."; "Docs conflict: The current command reference lists `all-traffic` as an allowed value, while the Direct VPC guide updated 2026-09-22 documents `all` as the all-outbound-traffic value and does not list `all-traffic`. The later guide differs from the release note; its value was not substituted."

### gcloud backup-dr backup-plans create and update configure log retention (2026-07-28)
- slug: gcloud-backup-dr-backup-plans-create-and-update-configure-log-retention-fdeeacf9cc5b
- score: 0.96

How to use it:

When creating or updating a Cloud Backup DR backup plan, set PITR log retention with `--log-retention-days=<days>`; the value must meet the backup vault’s minimum enforced retention duration.

Examples:

```
gcloud backup-dr backup-plans create <BACKUP_PLAN> --project=<PROJECT> --location=<LOCATION> --backup-vault=<BACKUP_VAULT> --resource-type=<RESOURCE_TYPE> --log-retention-days=<DAYS>
```

```
gcloud backup-dr backup-plans update <BACKUP_PLAN> --project=<PROJECT> --location=<LOCATION> --log-retention-days=<DAYS>
```

- why_it_matters: When creating or updating a Cloud Backup DR backup plan, configure Point-in-Time Recovery log retention.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#57800_2026-07-28>, <https://docs.cloud.google.com/sdk/gcloud/reference/backup-dr/backup-plans/create>, <https://docs.cloud.google.com/sdk/gcloud/reference/backup-dr/backup-plans/update>
- gotchas: "Availability: Available across all release tracks."; "BACKUP_PLAN (required): Backup plan name; it must be unique within the project and location when creating a plan."; "--project: Sets the project; the project can also be set in gcloud configuration or through a fully specified resource name."; "--location (required): Backup plan location."; "--backup-vault (required): Backup Vault ID or fully qualified identifier; required when creating a plan."; "--resource-type (required): Type of resource to which the backup plan applies; required when creating a plan."; "--log-retention-days: Number of days to store logs; must be greater than or equal to the backup vault’s minimum enforced retention duration."; "Prerequisite: Create the plan in a location where Backup and DR is available; update it in a region supported by the Backup and DR Service."; "Prerequisite: Set log retention to at least the backup vault’s minimum enforced retention duration."

### gcloud secrets create accepts --secret-type (2026-07-28)
- slug: gcloud-secrets-create-accepts-secret-type-a92babca9d74
- score: 0.92

How to use it:

When creating a Secret Manager secret with a specific type, pass `--secret-type=<type>` to `gcloud secrets create`. Choose one of the documented types, such as `cloud-sql-db-credentials`.

Examples:

```
gcloud secrets create <SECRET_ID> --secret-type=cloud-sql-db-credentials
```

- why_it_matters: When creating a secret with a type such as Cloud SQL credentials, set its secret type.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#57800_2026-07-28>, <https://docs.cloud.google.com/sdk/gcloud/reference/secrets/create>
- gotchas: "SECRET (required): Secret ID or fully qualified identifier."; "--secret-type: Secret type; allowed values: `access-key`, `certificate`, `cloud-sql-db-credentials`, `other`, `other-db-credentials`, `secret-type-unspecified`."; "The source gives Cloud SQL credentials as an example of a secret type."

### gcloud beta compute managed instance groups can adopt instances (2026-07-14)
- slug: gcloud-beta-compute-managed-instance-groups-can-adopt-instances-e68b10446657
- score: 0.93

How to use it:

When adopting existing instances into a regional managed instance group, run the beta `adopt-instances` command with the group name, instance names, and region.

Examples:

```
gcloud beta compute instance-groups managed adopt-instances <GROUP_NAME> --instances=<INSTANCE_1>,<INSTANCE_2> --region=<REGION>
```

- why_it_matters: Adopt instances into a regional managed instance group.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#57600_2026-07-14>, <https://docs.cloud.google.com/sdk/gcloud/reference/beta/compute/instance-groups/managed/adopt-instances>
- gotchas: "Availability: beta"; "<GROUP_NAME> (required): Name of the managed instance group."; "--instances (required): Comma-separated names of instances to adopt."; "--region: Region of the managed instance group; if omitted, gcloud might prompt for it in interactive mode."; "Prerequisite: Adoption is supported only for regional managed instance groups."; "Prerequisite: The command is in beta and might change without notice."; "The command supports adopting instances into regional managed instance groups."

### gcloud beta compute target-tcp-proxies create adds --load-balancing-scheme (2026-07-14)
- slug: gcloud-beta-compute-target-tcp-proxies-create-adds-load-balancing-scheme-b7125ba3ec2a
- announced: 2026-03-24
- status: ga
- score: 0.90

How to use it:

When creating a target TCP proxy, run the beta create command with a proxy name and `--load-balancing-scheme` set to a supported value.

Examples:

```
gcloud beta compute target-tcp-proxies create <PROXY_NAME> --load-balancing-scheme=EXTERNAL
```

- why_it_matters: Set a load-balancing scheme when creating a target TCP proxy.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#56200_2026-03-24>, <https://docs.cloud.google.com/sdk/gcloud/reference/beta/compute/target-tcp-proxies/create>, <https://docs.cloud.google.com/sdk/docs/release-notes#57600_2026-07-14>
- gotchas: "NAME (required): Name of the target TCP proxy to create."; "--load-balancing-scheme: Sets the target TCP proxy's load balancing scheme. Allowed values: `EXTERNAL`, `EXTERNAL_MANAGED`, `INTERNAL_MANAGED`."; "Prerequisite: The command is in beta and may change without notice."; "Availability: generally available since 2026-07-14"

### gcloud container cluster commands accept KCP_VPA logging option (2026-07-14)
- slug: gcloud-container-cluster-commands-accept-kcp-vpa-logging-option-d162f2549224
- score: 0.90

How to use it:

When enabling VPA Decision Logs for a GKE cluster, include `KCP_VPA` in `--logging` when creating or updating it.

Examples:

```
gcloud container clusters create <cluster-name> --logging=SYSTEM,KCP_VPA
```

```
gcloud container clusters create-auto <cluster-name> --logging=SYSTEM,WORKLOAD,KCP_VPA
```

```
gcloud container clusters update <cluster-name> --logging=SYSTEM,KCP_VPA
```

- why_it_matters: Enable VPA Decision Logs when creating or updating a Kubernetes Engine cluster.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#57600_2026-07-14>, <https://docs.cloud.google.com/sdk/gcloud/reference/container/clusters/create>, <https://docs.cloud.google.com/sdk/gcloud/reference/container/clusters/create-auto>, <https://docs.cloud.google.com/sdk/gcloud/reference/container/clusters/update>
- gotchas: "<cluster-name> (required): Cluster name positional argument."; "--logging: Sets the components that have logging enabled; accepts a comma-separated component list."; "KCP_VPA: Valid `--logging` component; added to enable VPA Decision Logs."; "SYSTEM: Valid `--logging` component; required in the list when `--logging` is set for `create-auto`."

### gcloud datalineage adds run and lineage-event command groups (2026-07-14)
- slug: gcloud-datalineage-adds-run-and-lineage-event-command-groups-9e51e0bde001
- score: 0.90

How to use it:

When managing Data Lineage, use `gcloud datalineage runs` to create or list runs and `gcloud datalineage lineage-events` to create events.

Examples:

```
gcloud datalineage runs create <run> --process=<process> --location=<location> --state=started --start-time=<RFC3339-time>
```

```
gcloud datalineage runs list --process=<process> --location=<location>
```

```
gcloud datalineage lineage-events create <event> --run=<run> --process=<process> --location=<location> --start-time=<RFC3339-time>
```

- why_it_matters: Manage data lineage runs using the gcloud datalineage command groups.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#57600_2026-07-14>, <https://docs.cloud.google.com/sdk/gcloud/reference/datalineage/runs/create>, <https://docs.cloud.google.com/sdk/gcloud/reference/datalineage/runs/list>, <https://docs.cloud.google.com/sdk/gcloud/reference/datalineage/lineage-events/create>, <https://docs.cloud.google.com/knowledge-catalog/docs/reference/data-lineage/rest/v1/projects.locations.processes.runs/create>
- gotchas: "<run> (required): Run ID or fully qualified identifier."; "--process (required): Process name for the run; required when listing runs."; "--location (required): Location of the run or process."; "--state (required): Run state: aborted, completed, failed, started, or unknown."; "--start-time (required): Run start time."; "<event> (required): Lineage event ID or fully qualified identifier."; "--run (required): Name of the run for the event."; "--process (required): Name of the process for the event."; "--location (required): Location of the event."; "--start-time (required): Event start time."; "Prerequisite: The gcloud command reference documents these command groups in release 576.0.0, dated 2026-07-14."; "Prerequisite: Creating runs requires IAM permission `datalineage.runs.create` on the parent process."

### gcloud beta run adds --dry-run validation for deploy, update and delete commands (2026-06-30)
- slug: gcloud-beta-run-adds-dry-run-validation-for-deploy-update-and-delete-commands-80cf11d0fff1
- score: 0.91

How to use it:

When you need to validate a Cloud Run service or worker-pool configuration without persisting changes, add `--dry-run` to one of the documented deploy, update, or delete commands. Provide the resource name and configuration arguments required for that command.

Examples:

```
gcloud beta run deploy <SERVICE> --image=<IMAGE> --dry-run
```

```
gcloud beta run services update <SERVICE> --dry-run
```

```
gcloud beta run worker-pools deploy <WORKER_POOL> --image=<IMAGE> --dry-run
```

- why_it_matters: Validate Cloud Run service or worker-pool configuration without persisting changes.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#57500_2026-06-30>, <https://docs.cloud.google.com/sdk/gcloud/reference/beta/run/deploy>, <https://docs.cloud.google.com/sdk/gcloud/reference/beta/run/services/update>, <https://docs.cloud.google.com/sdk/gcloud/reference/beta/run/worker-pools/deploy>
- gotchas: "Availability: beta"; "--dry-run: Optional flag on the listed commands; validates configuration without persisting changes."; "SERVICE (required): Service name positional argument for service deploy, update, and delete commands; deploy also requires an image or source configuration."; "WORKER_POOL (required): Worker-pool name positional argument; deploy also requires image or source configuration."; "--image: Specifies the container image for deployment; deployment commands also document `--source` as an alternative."; "The validation does not persist changes."

### gcloud beta run jobs execute adds --tail (2026-06-30)
- slug: gcloud-beta-run-jobs-execute-adds-tail-d5a29bbd0120
- score: 0.96

How to use it:

To execute a Cloud Run job and tail its execution logs, run `gcloud beta run jobs execute <JOB> --tail --region=<REGION>`.

Examples:

```
gcloud beta run jobs execute <JOB> --tail --region=<REGION>
```

- why_it_matters: Execute a Cloud Run job and follow logs of its running execution.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#57500_2026-06-30>, <https://docs.cloud.google.com/run/docs/execute/jobs>
- gotchas: "Availability: beta"; "JOB (required): Name of the Cloud Run job."; "--tail: Tail the execution logs immediately after launching the job."; "--region=<REGION>: Region containing the resource; alternatively set the `run/region` property."; "Prerequisite: For gcloud CLI execution, the `roles/run.invoker` role on the Cloud Run job is required."

### gcloud container node-pools create configures additional-interface stack type (2026-06-30)
- slug: gcloud-container-node-pools-create-configures-additional-interface-stack-type-001f410bfb0e
- score: 0.90

How to use it:

When creating a node pool with an additional network interface, set `stack-type` to the required IP stack: `ipv4`, `ipv4-ipv6`, or `ipv6`.

Examples:

```
gcloud container node-pools create <POOL_NAME> --cluster=<CLUSTER_NAME> --location=<LOCATION> --additional-node-network=network=<NETWORK_NAME>,subnetwork=<SUBNET_NAME>,stack-type=<ipv4|ipv4-ipv6|ipv6>
```

```
gcloud container node-pools create <POOL_NAME> --cluster=<CLUSTER_NAME> --location=<LOCATION> --additional-node-network network=<NETWORK_NAME>,subnetwork=<SUBNET_NAME>,stack-type=ipv6
```

- why_it_matters: Create a Kubernetes node pool whose additional network interfaces require a specific IP stack type.
- before: Before this release, `gcloud container node-pools create` did not provide the `stack-type` option for `--additional-node-network`.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#57500_2026-06-30>, <https://docs.cloud.google.com/sdk/gcloud/reference/container/node-pools/create>, <https://docs.cloud.google.com/kubernetes-engine/docs/how-to/setup-multinetwork-support-for-pods>
- gotchas: "<POOL_NAME> (required): Name of the new node pool."; "--cluster (required): Existing cluster to which the node pool is added."; "--location (required): Cluster location; specify a zone or region."; "--additional-node-network: Attach an additional network interface to each node; may be specified up to 7 times in the CLI reference."; "network (required): Network to attach to the new interface."; "subnetwork (required): Subnetwork to attach to the new interface."; "stack-type: Interface IP stack type: `ipv4`, `ipv4-ipv6`, or `ipv6`. The docs do not state these values are mutually exclusive beyond requiring one value for this parameter."; "Prerequisite: Create the node pool in an existing cluster. Multi-network setup requires a cluster with multi-networking enabled; the docs say to enable it only when Dataplane V2 is enabled."; "Prerequisite: Prepare the additional VPC and subnet. The selected stack type must be compatible with the subnet: IPv4-only permits `ipv4`, dual-stack permits all three, and IPv6-only permits `ipv6`."; "The stack-type choices stated are `ipv4`, `ipv4-ipv6`, or `ipv6`."

### gcloud dataproc clusters create adds --master-machine-types (2026-06-30)
- slug: gcloud-dataproc-clusters-create-adds-master-machine-types-b2a49a481404
- score: 0.93

How to use it:

When creating a Dataproc cluster that needs a specified master machine type, pass `--master-machine-types` with one or more `type=<MACHINE_TYPE>` entries and an optional `rank=<RANK>` to `gcloud dataproc clusters create`.

Examples:

```
gcloud dataproc clusters create <cluster> --region=<region> --master-machine-types="type=<MACHINE_TYPE>"
```

```
gcloud dataproc clusters create <cluster> --region=<region> --master-machine-types="type=<MACHINE_TYPE_1>,type=<MACHINE_TYPE_2>,rank=<RANK>"
```

- why_it_matters: Create a Dataproc cluster with the required master machine type.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#57500_2026-06-30>, <https://docs.cloud.google.com/sdk/gcloud/reference/dataproc/clusters/create>
- gotchas: "<cluster> (required): Cluster ID or fully qualified cluster identifier."; "--region=<region> (required): Region for the cluster."; "--master-machine-types: Machine types for master nodes; defaults to server-specified when omitted."; "type=<MACHINE_TYPE> (required): A machine type to use for master nodes; repeat `type=` to provide alternatives."; "rank=<RANK>: Optional rank value accepted by the flag; the docs do not explain its effect for master nodes."

### gcloud network-management connectivity-tests adds --source-cloud-run-job (2026-06-30)
- slug: gcloud-network-management-connectivity-tests-adds-source-cloud-run-job-58c874743877
- score: 0.94

How to use it:

To test connectivity from a Cloud Run job, create a connectivity test with `--source-cloud-run-job` and a destination endpoint.

Examples:

```
gcloud network-management connectivity-tests create <TEST_NAME> --protocol=<PROTOCOL> --source-cloud-run-job=projects/<PROJECT_ID>/locations/<REGION>/jobs/<JOB_NAME> --destination-instance=<DESTINATION_INSTANCE_URI> --destination-ip-address=<DESTINATION_IP_ADDRESS> --destination-port=<DESTINATION_PORT> --round-trip
```

- why_it_matters: Run a connectivity test whose source is a Cloud Run job.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#57500_2026-06-30>, <https://docs.cloud.google.com/network-intelligence-center/docs/connectivity-tests/how-to/running-connectivity-tests>, <https://docs.cloud.google.com/sdk/gcloud/reference/network-management/connectivity-tests/create>
- gotchas: "<TEST_NAME> (required): Name of the connectivity test."; "--source-cloud-run-job (required): Cloud Run job URI as the source endpoint; example format: `projects/<PROJECT_ID>/locations/<REGION>/jobs/<JOB_NAME>`."; "--destination-instance (required): Destination VM instance URI."; "--destination-ip-address (required): IP address of the destination; it can be external or internal."; "--destination-port (required): Destination port."; "--protocol: Protocol for the test; defaults to TCP. For Serverless VPC Access connectors, only TCP and UDP are supported."; "--round-trip: Also calculate return traces if the packet reaches the destination."

### gcloud sql instances execute-sql adds user and secret-version options (2026-06-30)
- slug: gcloud-sql-instances-execute-sql-adds-user-and-secret-version-options-af122265ac18
- score: 0.97

How to use it:

To execute SQL with password authentication, pass the database user and Secret Manager password version to `gcloud sql instances execute-sql`.

Examples:

```
gcloud sql instances execute-sql <INSTANCE> --sql='<SQL_STATEMENT>' --database=<DATABASE> --user=<USER> --password-secret-version=projects/<PROJECT>/locations/<LOCATION>/secrets/<SECRET>/versions/<SECRET_VERSION>
```

- why_it_matters: Execute SQL against a Cloud SQL instance using a user and password secret version.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#57500_2026-06-30>, <https://docs.cloud.google.com/sdk/gcloud/reference/sql/instances/execute-sql>, <https://docs.cloud.google.com/sql/docs/mysql/executesql-instance?hl=en>
- gotchas: "INSTANCE (required): Cloud SQL instance ID."; "--sql (required): SQL statement(s) to execute; multiple statements are supported."; "--database: Database on which to execute the statement."; "--user: Database user to authenticate as; used together with `--password-secret-version`."; "--password-secret-version: Secret Manager resource name holding the user's password; used together with `--user`. Expected format: `projects/{project}/locations/{location}/secrets/{secret}/versions/{secret_version}`."; "Prerequisite: Configure the database user and permissions according to the Cloud SQL Data API instructions before executing statements."; "Prerequisite: The password secret must be regional and stored in the same region as the Cloud SQL instance."

### Cloud Memorystore create commands accept zone distribution zones (2026-06-23)
- slug: cloud-memorystore-create-commands-accept-zone-distribution-zones-2e6e376c3698
- score: 0.95

How to use it:

When creating a `MULTI_ZONE` Memorystore instance or Redis cluster, specify the zones with `--zone-distribution-config-zones` for the instance command. The current Redis cluster reference documents a different flag, so its matching syntax could not be verified there.

Examples:

```
gcloud memorystore instances create <INSTANCE> --zone-distribution-config-zones=<ZONE>,<ZONE>
```

```
gcloud redis clusters create <CLUSTER> --region=<REGION> --zone-distribution-config-zones=<ZONE>,<ZONE>
```

- why_it_matters: Create a Cloud Memorystore or Redis cluster with a `MULTI_ZONE` configuration spanning specified zones.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#57400_2026-06-23>, <https://docs.cloud.google.com/sdk/gcloud/reference/memorystore/instances/create>, <https://docs.cloud.google.com/sdk/gcloud/reference/redis/clusters/create>
- gotchas: "--zone-distribution-config-zones: Zone list for multi-zone instance resource allocation; not applicable to single-zone instances."; "--zone-distribution-config-mode: Zone distribution mode; defaults to `MULTI_ZONE`. Documented values: `multi-zone` and `single-zone`."; "INSTANCE (required): Memorystore instance ID."; "CLUSTER (required): Redis cluster ID."; "--region (required): Redis cluster region, unless supplied through a fully qualified cluster identifier or `redis/region` property."; "The flag is described for creating a `MULTI_ZONE` cluster."; "Docs conflict: The current Redis cluster reference documents `--zones`, not `--zone-distribution-config-zones`; its current mode values are `multi-zone` and `single-zone`. The release note names `--zone-distribution-config-zones` for the change, so the current reference does not verify that Redis flag's exact syntax or parameters."

### gcloud colab runtime-templates create accepts HYPERDISK_BALANCED (2026-06-23)
- slug: gcloud-colab-runtime-templates-create-accepts-hyperdisk-balanced-a0de8d00763a
- score: 0.92

How to use it:

When creating a Colab runtime template with a Hyperdisk balanced disk, set `--disk-type=HYPERDISK_BALANCED` and provide the required display name.

Examples:

```
gcloud colab runtime-templates create --display-name=<display-name> --disk-type=HYPERDISK_BALANCED
```

- why_it_matters: Create a Colab runtime template with a Hyperdisk balanced disk.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#57400_2026-06-23>, <https://docs.cloud.google.com/sdk/gcloud/reference/colab/runtime-templates/create>
- gotchas: "--display-name (required): Runtime template display name."; "--disk-type: Disk type; accepted values include `HYPERDISK_BALANCED`."

### gcloud beta workstations update changes workstation properties (2026-06-09)
- slug: gcloud-beta-workstations-update-changes-workstation-properties-29496f9855ab
- score: 0.98

How to use it:

When increasing a workstation’s persistent directory size, stop the workstation first, then run the update command with a target size larger than its current size.

Examples:

```
gcloud beta workstations update <WORKSTATION_NAME> --pd-disk-size=<TARGET_SIZE_GB> --project=<PROJECT_ID> --region=<REGION> --cluster=<CLUSTER_NAME> --config=<CONFIG_NAME>
```

- why_it_matters: Update a Cloud Workstations workstation property, such as its persistent directory disk size.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#57200_2026-06-09>, <https://docs.cloud.google.com/workstations/docs/resize-workstation-persistent-directories>, <https://docs.cloud.google.com/sdk/gcloud/reference/beta/workstations/update>
- gotchas: "Availability: beta"; "WORKSTATION_NAME (required): Workstation name."; "--pd-disk-size=<TARGET_SIZE_GB> (required): Desired persistent directory size in GB; for resizing, it must be larger than the current size."; "--project=<PROJECT_ID> (required): Project containing the workstation."; "--region=<REGION> (required): Region where the workstation resides."; "--cluster=<CLUSTER_NAME> (required): Workstation cluster name."; "--config=<CONFIG_NAME> (required): Workstation configuration name."; "--async: Return immediately without waiting for the operation to complete."; "Prerequisite: Stop the workstation before resizing its persistent directory."

### gcloud workbench instances upgrade accepts --image-family (2026-06-09)
- slug: gcloud-workbench-instances-upgrade-accepts-image-family-0c9a569d910a
- score: 0.92

How to use it:

To upgrade a Workbench instance to the latest image in a different family, pass that family's full Compute Engine resource name with `--image-family`.

Examples:

```
gcloud workbench instances upgrade <INSTANCE_NAME> --location=<LOCATION> --image-family=projects/<IMAGE_PROJECT>/global/images/family/<IMAGE_FAMILY>
```

- why_it_matters: Select an image family when upgrading a Workbench instance.
- before: If `--image-family` is omitted, the instance upgrades to the latest image in its current image family.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#57200_2026-06-09>, <https://docs.cloud.google.com/gemini-enterprise-agent-platform/notebooks/workbench/instances/manage-image-versions>, <https://docs.cloud.google.com/sdk/gcloud/reference/workbench/instances/upgrade>
- gotchas: "INSTANCE_NAME (required): Name of the instance."; "--location (required): Google Cloud location of the environment."; "--image-family: Full resource name in `projects/{project_id}/global/images/family/{image_family}` format; selects the latest image in that family and allows upgrades across families."; "IMAGE_PROJECT (required): Project hosting the image family."; "IMAGE_FAMILY (required): Target image family name."

### gcloud alloydb instances create and update support instance labels (2026-06-02)
- slug: gcloud-alloydb-instances-create-and-update-support-instance-labels-5498c59e41f1
- score: 0.96

How to use it:

When creating or maintaining an AlloyDB instance, use `--labels` on create or create-secondary to assign labels; use the update command’s label flags to change, remove, or clear them.

Examples:

```
gcloud alloydb instances create <instance> --cluster=<cluster> --region=<region> --instance-type=<instance-type> --labels=<key>=<value>
```

```
gcloud alloydb instances create-secondary <instance> --cluster=<cluster> --region=<region> --labels=<key>=<value>
```

```
gcloud alloydb instances update <instance> --update-labels=<key>=<value> [--remove-labels=<key>,… | --clear-labels]
```

- why_it_matters: When creating, creating a secondary, or maintaining an AlloyDB instance, assign or change its labels.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#57100_2026-06-02>, <https://docs.cloud.google.com/sdk/gcloud/reference/alloydb/instances/create>, <https://docs.cloud.google.com/sdk/gcloud/reference/alloydb/instances/create-secondary>, <https://docs.cloud.google.com/sdk/gcloud/reference/alloydb/instances/update>
- gotchas: "--labels: On create and create-secondary, list of label KEY=VALUE pairs to add. Keys and values must start with a lowercase character and contain only hyphens, underscores, lowercase characters, and numbers."; "--update-labels: List of label KEY=VALUE pairs to update; changes existing values or creates new labels. Keys and values must start with a lowercase character and contain only hyphens, underscores, lowercase characters, and numbers."; "--remove-labels: List of label keys to remove; missing labels are silently ignored. Mutually exclusive with `--clear-labels`; if combined with `--update-labels`, updates apply first."; "--clear-labels: Remove all labels. Mutually exclusive with `--remove-labels`; if combined with `--update-labels`, clearing applies first."

### gcloud datastream objects start-backfill filters partial backfills (2026-06-02)
- slug: gcloud-datastream-objects-start-backfill-filters-partial-backfills-8cb998404183
- score: 0.94

How to use it:

When you need to backfill only matching rows from a supported SQL source, run `gcloud datastream objects start-backfill` for the object with `--sql-where-clause` set to the filter, without the `WHERE` keyword.

Examples:

```
gcloud datastream objects start-backfill <object> --stream=<stream> --location=<location> --sql-where-clause="t.key1 = 'value1'"
```

- why_it_matters: When backfilling only matching records from a Datastream object, start a partial backfill with a SQL where clause.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#57100_2026-06-02>, <https://docs.cloud.google.com/sdk/gcloud/reference/datastream/objects/start-backfill>, <https://docs.cloud.google.com/datastream/docs/manage-backfill-for-the-objects-of-a-stream>
- gotchas: "OBJECT (required): ID or fully qualified identifier of the stream object."; "--stream (required): Stream name; can be supplied in the fully qualified object identifier instead."; "--location (required): Resource location; can be supplied in the fully qualified object identifier instead."; "--sql-where-clause: SQL WHERE clause selecting included data, without the `WHERE` keyword. Supported only for SQL sources."; "Prerequisite: Partial backfill is supported only for SQL sources. Oracle, PostgreSQL, and MySQL support is being made available gradually; a request fails if the stream does not yet support the feature."; "Prerequisite: The object must not have `Pending` or `Active` status when initiating backfill."; "The partial backfill is on the specified object."

### gcloud storage batch-operations jobs create accepts --set-object-acls-from-file (2026-06-02)
- slug: gcloud-storage-batch-operations-jobs-create-accepts-set-object-acls-from-file-9d467eb71c05
- score: 0.95

How to use it:

When creating a batch job to update object ACLs, provide a local YAML or JSON ACL updates file with `--set-object-acls-from-file`. Specify a job ID, object source, and exactly one transformation; the source may be bucket based or project based.

Examples:

```
gcloud storage batch-operations jobs create <job-id> --bucket=<bucket> --manifest-location=gs://<bucket>/<manifest.csv> --set-object-acls-from-file=<local-acl-updates.yaml>
```

- why_it_matters: When creating a Cloud Storage batch-operation job that sets object ACLs from a file, provide that file to the create command.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#57100_2026-06-02>, <https://docs.cloud.google.com/sdk/gcloud/reference/storage/batch-operations/jobs/create>
- gotchas: "<job-id> (required): Batch job ID or fully qualified identifier."; "--bucket (required): Bucket containing target objects; select exactly one of --bucket or --bucket-list for a bucket source."; "--manifest-location (required): Absolute gs:// path to a CSV manifest; choose this or --included-object-prefixes for a bucket source."; "--set-object-acls-from-file (required): Path to a local YAML or JSON file containing object ACL updates; provide exactly one transformation option."; "grants[].entity: Entity receiving an ACL grant; each entry pairs an entity and role."; "grants[].role: Role assigned to the corresponding entity."; "grants[].remove_entities: Entities whose ACL grants are removed."; "Prerequisite: The ACL updates input must be a local YAML or JSON file. The bucket manifest, if used, must be a CSV in Cloud Storage with ProjectId, BucketId, and Name per row; generation is optional."

### gcloud backup-dr restore compute and disk support project service account (2026-05-27)
- slug: gcloud-backup-dr-restore-compute-and-disk-support-project-service-account-9248093f29b3
- score: 0.91

How to use it:

For a same-project restore that must use the project service agent’s credentials, add `--use-project-service-account` to the compute or disk restore command.

Examples:

```
gcloud backup-dr backups restore compute <backup> --project=<project> --location=<location> --backup-vault=<backup-vault> --data-source=<data-source> --name=<instance-name> --target-project=<target-project> --target-zone=<target-zone> --use-project-service-account
```

```
gcloud backup-dr backups restore disk <backup> --project=<project> --location=<location> --backup-vault=<backup-vault> --data-source=<data-source> --name=<disk-name> --target-project=<target-project> --target-zone=<target-zone> --use-project-service-account
```

- why_it_matters: Restore a compute backup or disk using the project service account when required by the restore workflow.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#57000_2026-05-27>, <https://docs.cloud.google.com/sdk/gcloud/reference/backup-dr/backups/restore/compute>, <https://docs.cloud.google.com/sdk/gcloud/reference/backup-dr/backups/restore/disk>
- gotchas: "--use-project-service-account: Use BackupDR Project Service Agent credentials instead of the Backup Vault Service Account; supported only for same-project restores."; "<backup>, --project, --location, --backup-vault, --data-source (required): Identify the backup and its project, location, backup vault, and data source; project can be supplied by a fully specified backup name or `core/project`."; "--name, --target-project (required): Set the restored resource name and destination project."; "--target-zone (required): Set the destination zone for a compute restore; for disk restore, this is optional and mutually exclusive with `--target-region`."; "--target-region: Set the destination region for a disk restore; mutually exclusive with `--target-zone`."; "Prerequisite: The restore must be same-project to use `--use-project-service-account`."

### gcloud compute managed instance groups configure autoscaler stabilization period (2026-05-27)
- slug: gcloud-compute-managed-instance-groups-configure-autoscaler-stabilization-period-334d6c204c9e
- score: 0.91

How to use it:

When configuring autoscaling for a managed instance group, set `--stabilization-period` to the number of seconds the autoscaler waits for load to stabilize before making scale-in decisions.

Examples:

```
gcloud compute instance-groups managed set-autoscaling <MIG_NAME> --max-num-replicas=<MAX_REPLICAS> --stabilization-period=<SECONDS>
```

```
gcloud compute instance-groups managed update-autoscaling <MIG_NAME> --stabilization-period=<SECONDS>
```

- why_it_matters: Configure how long the autoscaler waits to stabilize load before making scale-in decisions.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#57000_2026-05-27>, <https://docs.cloud.google.com/sdk/gcloud/reference/compute/instance-groups/managed/set-autoscaling>, <https://docs.cloud.google.com/sdk/gcloud/reference/compute/instance-groups/managed/update-autoscaling>
- gotchas: "<MIG_NAME> (required): Name of the managed instance group to operate on."; "--max-num-replicas (required): Maximum number of replicas the autoscaler can set; required by `set-autoscaling`."; "--stabilization-period: Number of seconds the autoscaler waits for load stabilization before making scale-in decisions."

### gcloud dataplex context lookup includes all schema fields (2026-05-27)
- slug: gcloud-dataplex-context-lookup-includes-all-schema-fields-8e66aef6cc92
- score: 0.91

How to use it:

When an agent needs Dataplex context with every schema field, run `gcloud dataplex context lookup` with the required `--resources` value and add `--all-schema-fields`.

Examples:

```
gcloud dataplex context lookup --resources=<entry-name> --all-schema-fields
```

- why_it_matters: Look up Dataplex context with every schema field included.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#57000_2026-05-27>, <https://docs.cloud.google.com/sdk/gcloud/reference/dataplex/context/lookup>
- gotchas: "--resources (required): Resource identifier to look up, such as `projects/<project>/locations/<location>/entryGroups/<entry-group>/entries/<entry>`."; "--all-schema-fields: Includes all schema fields in the context."

### gcloud spanner instances create and update labels (2026-05-27)
- slug: gcloud-spanner-instances-create-and-update-labels-7634c3d4b3be
- score: 0.92

How to use it:

When creating a Cloud Spanner instance, pass labels with `--labels`; when maintaining one, use `--update-labels` to add or change labels, `--remove-labels` to remove selected keys, or `--clear-labels` to remove all labels.

Examples:

```
gcloud spanner instances create <INSTANCE_ID> --config=<INSTANCE_CONFIG> --description=<INSTANCE_NAME> --nodes=<NODE_COUNT> --labels=<KEY>=<VALUE>,<KEY>=<VALUE>
```

```
gcloud spanner instances update <INSTANCE_ID> --update-labels=<KEY>=<VALUE>,<KEY>=<VALUE>
```

```
gcloud spanner instances update <INSTANCE_ID> --remove-labels=<KEY1>,<KEY2>
gcloud spanner instances update <INSTANCE_ID> --clear-labels
```

- why_it_matters: Set labels when creating or maintaining a Cloud Spanner instance.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#57000_2026-05-27>, <https://docs.cloud.google.com/spanner/docs/labels>, <https://docs.cloud.google.com/sdk/gcloud/reference/spanner/instances/create>, <https://docs.cloud.google.com/sdk/gcloud/reference/spanner/instances/update>
- gotchas: "--labels=<KEY>=<VALUE>,…: List of label key-value pairs to add during creation. Keys and values allow lowercase letters, numbers, hyphens, and underscores."; "--update-labels=<KEY>=<VALUE>,…: Update existing label values or create new labels. Keys and values allow lowercase letters, numbers, hyphens, and underscores."; "--clear-labels: Remove all labels. Mutually exclusive with `--remove-labels`; if used with `--update-labels`, clearing is applied first."; "--remove-labels=<KEY>,…: Remove listed label keys; missing keys are ignored. Mutually exclusive with `--clear-labels`; if used with `--update-labels`, updates are applied first."; "INSTANCE_ID (required): Cloud Spanner instance ID."; "--config=<INSTANCE_CONFIG> (required): Instance configuration defining geographic placement and database replication."; "--description=<INSTANCE_NAME> (required): Instance description."; "Prerequisite: To view and manage instance labels, the docs require IAM permissions `spanner.instances.get` and `spanner.instances.update`; these are included in `roles/spanner.admin`."

### gcloud storage anywhere-caches configure ingest on write (2026-05-27)
- slug: gcloud-storage-anywhere-caches-configure-ingest-on-write-e384dd598a0d
- score: 0.97

How to use it:

When creating or updating an Anywhere Cache, pass `--enable-ingest-on-write` to enable ingest-on-write. Then describe the cache to inspect its parsed properties.

Examples:

```
gcloud storage buckets anywhere-caches create gs://<BUCKET_NAME> <CACHE_ZONE> --enable-ingest-on-write
```

```
gcloud storage buckets anywhere-caches update <BUCKET_NAME>/<CACHE_ZONE> --enable-ingest-on-write
```

```
gcloud storage buckets anywhere-caches describe <BUCKET_NAME>/<CACHE_ZONE>
```

- why_it_matters: Enable cache ingest on write when creating or updating an anywhere cache and confirm the parsed property.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#57000_2026-05-27>, <https://docs.cloud.google.com/storage/docs/rapid/use-rapid-cache>, <https://docs.cloud.google.com/sdk/gcloud/reference/storage/buckets/anywhere-caches/create>, <https://docs.cloud.google.com/sdk/gcloud/reference/storage/buckets/anywhere-caches/update>, <https://docs.cloud.google.com/sdk/gcloud/reference/storage/buckets/anywhere-caches/describe>
- gotchas: "URL (required): Bucket URL for cache creation; documented form is `gs://<BUCKET_NAME>`."; "ZONE (required): Zonal location for the cache; multiple zones may be supplied."; "ID (required): Cache identifier, combining bucket name and cache ID, e.g. `<BUCKET_NAME>/<CACHE_ZONE>`."; "--enable-ingest-on-write: Enables the Ingest-on-Write feature. The corresponding `--no-enable-ingest-on-write` form disables it. The Rapid Cache guide says this flag enables ingest for all objects written to the bucket."; "--raw: For describe, emits metadata in the API response format instead of the standardized format."; "Prerequisite: Grant `roles/storage.admin` on the bucket, or equivalent permissions. Ingest-on-write additionally requires `storage.managedFolders.create` when creating a cache and `storage.managedFolders.update` when updating one."

### KMS Autokey config supports project-level operations and key-resolution-mode (2026-05-19)
- slug: kms-autokey-config-supports-project-level-operations-and-key-resolution-mode-e7b028e73826
- score: 0.95

How to use it:

To inspect a project Autokey configuration, run `gcloud beta kms autokey-config describe --project=<project-id>`. To update it, put the project resource name and desired `keyProjectResolutionMode` in a YAML config file, then run `gcloud beta kms autokey-config update <config-file> --project=<project-id>`.

Examples:

```
gcloud beta kms autokey-config describe --project=<project-id>
```

```
# <config-file>.yaml
name: projects/<project-id>/autokeyConfig
keyProjectResolutionMode: RESOURCE_PROJECT
keyProject: ''

gcloud beta kms autokey-config update <config-file>.yaml --project=<project-id>
```

- why_it_matters: Describe or update a project-level Autokey configuration, including its key resolution mode.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#56900_2026-05-19>, <https://docs.cloud.google.com/sdk/gcloud/reference/beta/kms/autokey-config/describe>, <https://docs.cloud.google.com/kms/docs/enable-autokey>, <https://docs.cloud.google.com/sdk/gcloud/reference/beta/kms/autokey-config/update>, <https://docs.cloud.google.com/kms/docs/reference/rest/v1/AutokeyConfig>
- gotchas: "Availability: beta"; "--project=<project-id> (required): Project id for the configuration; describe requires exactly one of --project or --folder. It is also a gcloud-wide flag for update."; "<config-file> (required): File containing the AutokeyConfig resource to update."; "name (required): AutokeyConfig resource name, e.g. projects/<project-id>/autokeyConfig."; "keyProjectResolutionMode: Mode for resolving the key project. Allowed values: DEDICATED_KEY_PROJECT, RESOURCE_PROJECT, DISABLED. Docs do not state these values are mutually exclusive; they are enum alternatives."; "keyProject: Key project name. Empty value clears the configuration; guide's RESOURCE_PROJECT example leaves it empty."

### gcloud firestore indexes composite create adds search configuration options (2026-05-12)
- slug: gcloud-firestore-indexes-composite-create-adds-search-configuration-options-a69e9d9545a4
- score: 0.93

How to use it:

To create a beta composite Firestore search index, run `gcloud beta firestore indexes composite create` with a search-config field and, if needed, search-index-options.

Examples:

```
gcloud beta firestore indexes composite create --database=<DATABASE_ID> --collection-group=<COLLECTION_GROUP> --field-config=field-path=<FIELD_NAME>,search-config='{"text-spec":{"index-specs":[{"index-type":"tokenized","match-type":"match-globally"}]}}' --search-index-options=text-language=<BCP47_LANGUAGE>
```

- why_it_matters: Create a beta composite Firestore index with search configuration options.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#56800_2026-05-12>, <https://docs.cloud.google.com/sdk/gcloud/reference/beta/firestore/indexes/composite/create>
- gotchas: "Availability: beta"; "--collection-group (required): Collection group ID to index."; "--database: Database ID; defaults to `(default)`."; "--field-config (required): Index field configuration. `field-path` is required. A search field uses `search-config`; an index definition must contain only search-config fields or only non-search-config fields."; "search-config.geo-spec: Geo search field specification. `geo-json-indexing-disabled` is an optional sub-key that disables GeoJSON indexing; by default GeoJSON points are indexed."; "search-config.text-spec: Text search field specification. `index-specs` is an optional array; each entry requires `index-type` and `match-type`."; "--search-index-options: Search index definition options. `text-language` is an optional BCP 47 language code used as the default; `text-language-override-field-path` is an optional document field path for per-document language. Docs do not state these sub-keys are mutually exclusive."; "text-spec.index-specs[].index-type (required): Specifies how to index the text field value; documented example value: `tokenized`."; "text-spec.index-specs[].match-type (required): Specifies how to match the text field value; documented example value: `match-globally`."

### gcloud compute resource policies accept --accelerator-topology-mode (2026-05-05)
- slug: gcloud-compute-resource-policies-accept-accelerator-topology-mode-f96627316a57
- announced: 2026-01-21
- status: ga
- score: 0.93

How to use it:

When creating a workload policy or group placement policy, pass `--accelerator-topology-mode` with `AUTO_CONNECT` or `PROVISION_ONLY` to set the accelerator connection strategy.

Examples:

```
gcloud compute resource-policies create workload-policy <POLICY_NAME> --type=HIGH_THROUGHPUT --accelerator-topology-mode=PROVISION_ONLY --region=<REGION>
```

```
gcloud compute resource-policies create group-placement <POLICY_NAME> --accelerator-topology-mode=PROVISION_ONLY --region=<REGION>
```

- why_it_matters: Create a workload policy or group placement policy with an accelerator topology mode.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#55300_2026-01-21>, <https://docs.cloud.google.com/sdk/gcloud/reference/compute/resource-policies/create/workload-policy>, <https://docs.cloud.google.com/sdk/gcloud/reference/compute/resource-policies/create/group-placement>, <https://docs.cloud.google.com/sdk/docs/release-notes#56700_2026-05-05>
- gotchas: "POLICY_NAME (positional NAME) (required): Name of the resource policy."; "--type (required): Required for workload policies; choose `HIGH_AVAILABILITY` or `HIGH_THROUGHPUT`."; "--accelerator-topology-mode: Sets the accelerator connection strategy: `AUTO_CONNECT` creates a static, pre-formed topology; `PROVISION_ONLY` connects chips on demand, so they are not connected when the VM is created."; "--region: Region for the resource policy; omission can prompt for a region in interactive mode."; "Availability: generally available since 2026-05-05"

### gcloud container node-pools create adds --subnetwork (2026-04-28)
- slug: gcloud-container-node-pools-create-adds-subnetwork-31113ceb86fc
- announced: 2026-01-21
- score: 0.91

How to use it:

When creating a node pool on a cluster with multiple available subnets, pass `--subnetwork` to choose one. The subnet must already be assigned to the cluster.

Examples:

```
gcloud container node-pools create <POOL_NAME> --cluster=<CLUSTER_NAME> --location=<LOCATION> --subnetwork=<SUBNET_NAME>
```

- why_it_matters: Choose a subnetwork when creating a Kubernetes Engine node pool.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#56600_2026-04-28>, <https://docs.cloud.google.com/kubernetes-engine/docs/how-to/multi-subnet-cluster>, <https://docs.cloud.google.com/sdk/gcloud/reference/container/node-pools/create>, <https://docs.cloud.google.com/sdk/docs/release-notes#55300_2026-01-21>
- gotchas: "POOL_NAME (required): Name of the new node pool."; "--cluster: Cluster to add the node pool to."; "--location: Cluster region or zone."; "--subnetwork: Name or full resource path of the subnet to use; the subnet must already be assigned to the cluster."; "Prerequisite: Install and initialize the gcloud CLI; set a default compute region or zone, or supply the cluster location."; "Prerequisite: For additional subnets, the cluster must be VPC-native and run GKE 1.30.3-gke.1211000 or later. The selected subnet must already be assigned to the cluster."

### gcloud dataplex entries modify command (2026-04-28)
- slug: gcloud-dataplex-entries-modify-command-b409f603618b
- score: 0.90

How to use it:

When modifying a Dataplex entry, run `gcloud dataplex entries modify` with the entry ID and its entry group and location; add the documented flags for the fields to change. The command modifies specified fields.

Examples:

```
gcloud dataplex entries modify <entry> --project=<project> --location=<location> --entry-group=<entry-group> --entry-source-description='<description>' --entry-source-update-time='<date-time>'
```

```
gcloud dataplex entries modify <entry> --project=<project> --location=<location> --entry-group=<entry-group> --update-aspects=<yaml-or-json-file>
```

- why_it_matters: Modify a Dataplex entry.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#56600_2026-04-28>, <https://docs.cloud.google.com/sdk/gcloud/reference/dataplex/entries/modify>
- gotchas: "<entry> (required): Entry ID or fully qualified identifier."; "--project (required): Project containing the entry; can also be set through the fully specified entry name or `core/project`."; "--entry-group (required): Entry group containing the entry."; "--location (required): Location of the Dataplex resource; can also be set through the fully specified entry name or `dataplex/location`."; "--entry-source-description: Set the entry description. If any entry-source field is specified, `--entry-source-update-time` is also required. Mutually exclusive with `--clear-entry-source-description`."; "--entry-source-update-time (required): Update date and time in the source system; required when any other entry-source field is specified."; "--update-aspects: Path to a YAML or JSON file of aspects to add or update; each referenced aspect is fully replaced, while unlisted aspects remain."; "--remove-aspects: Aspect keys to remove, formatted as `ASPECT_TYPE@PATH` or `ASPECT_TYPE`; both type and path cannot be wildcards. If an aspect key is also in `--update-aspects`, the update takes precedence."; "--clear-fully-qualified-name / --fully-qualified-name: Clear or set the entry's fully qualified name; mutually exclusive."

### gcloud logging recent-queries adds list command (2026-04-28)
- slug: gcloud-logging-recent-queries-adds-list-command-71df42450337
- score: 0.91

How to use it:

To list Cloud Logging recent queries, run `gcloud logging recent-queries list` with a location and one parent resource.

Examples:

```
gcloud logging recent-queries list --project=<PROJECT_ID> --location=global
```

- why_it_matters: List recent queries in Cloud Logging.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#56600_2026-04-28>, <https://docs.cloud.google.com/sdk/gcloud/reference/logging/recent-queries/list>, <https://cloud.google.com/logging/docs/reference/v2/rest/v2/billingAccounts.locations.recentQueries/list>
- gotchas: "--location (required): Location of the recent queries to list."; "--project (required): Project that owns the recent queries. At most one of `--project`, `--billing-account`, `--folder`, or `--organization` may be specified."; "--billing-account: Billing account parent for the recent queries; mutually exclusive with `--project`, `--folder`, and `--organization`."; "--folder: Folder parent for the recent queries; mutually exclusive with `--project`, `--billing-account`, and `--organization`."; "--organization: Organization parent for the recent queries; mutually exclusive with `--project`, `--billing-account`, and `--folder`."; "Prerequisite: The caller needs the `logging.queries.list` permission on the parent resource."; "Prerequisite: The API requires one of the OAuth scopes `logging.read`, `logging.admin`, `cloud-platform.read-only`, or `cloud-platform`."

### gcloud scc sources list command (2026-04-28)
- slug: gcloud-scc-sources-list-command-21f273797123
- score: 0.94

How to use it:

When you need to list Security Command Center sources, run `gcloud scc sources list` with a parent organization, folder, or project—or configure `scc/parent`.

Examples:

```
gcloud scc sources list <organizations/ORG_ID|folders/FOLDER_ID|projects/PROJECT_ID>
```

- why_it_matters: List Security Command Center sources.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#56600_2026-04-28>, <https://docs.cloud.google.com/sdk/gcloud/reference/scc/sources/list>
- gotchas: "PARENT: Parent organization, folder, or project; can be provided as a fully qualified resource ID or ID alone. If omitted, the command uses the configured `scc/parent` property."; "--filter=EXPRESSION: List only resources for which the Boolean filter evaluates true."; "--limit=LIMIT: Maximum number of resources to list; defaults to unlimited."; "--page-size=PAGE_SIZE: Maximum resources per page; default is determined by the service when paging is supported."; "--sort-by=FIELD: Comma-separated resource fields for sorting; ascending by default, or prefix a field with `~` for descending order."

### gcloud beta run worker-pools logs adds read and tail (2026-04-14)
- slug: gcloud-beta-run-worker-pools-logs-adds-read-and-tail-ddbc512f9ca9
- announced: 2026-01-06
- status: ga
- score: 0.95

How to use it:

To view a worker pool's logs, run `gcloud beta run worker-pools logs read <worker-pool>` for entries or `gcloud beta run worker-pools logs tail <worker-pool>` to stream them in real time.

Examples:

```
gcloud beta run worker-pools logs read <worker-pool>
```

```
gcloud beta run worker-pools logs tail <worker-pool>
```

- why_it_matters: View logs for a Cloud Run worker pool.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#55100_2026-01-06>, <https://docs.cloud.google.com/sdk/gcloud/reference/beta/run/worker-pools/logs/read>, <https://docs.cloud.google.com/sdk/gcloud/reference/beta/run/worker-pools/logs/tail>, <https://docs.cloud.google.com/sdk/docs/release-notes#56500_2026-04-14>
- gotchas: "WORKER_POOL (required): Name for a Cloud Run worker pool."; "--log-filter: Filter expression specifying which log entries to return."; "--region: Region containing the resource; alternatively set the `run/region` property."; "--freshness: For `read`, maximum age of returned entries; defaults to `1d`. Applies only with descending order and filters without a timestamp."; "--order: For `read`, timestamp order: `desc` or `asc`; defaults to `desc`."; "--limit: For `read`, maximum number of entries; default is unlimited."; "Availability: generally available since 2026-04-14"

### gcloud beta run commands add ephemeral-disk volumes (2026-04-07)
- slug: gcloud-beta-run-commands-add-ephemeral-disk-volumes-edf265b95f89
- score: 0.91

How to use it:

When configuring a Cloud Run service, job, or worker pool with an ephemeral disk, use the beta `gcloud run` command with `--add-volume` and `--add-volume-mount` to define and mount it.

Examples:

```
gcloud beta run services update <SERVICE> --execution-environment=gen2 --add-volume=name=<VOLUME_NAME>,type=ephemeral-disk,size=<SIZE> --add-volume-mount=volume=<VOLUME_NAME>,mount-path=<MOUNT_PATH>
```

```
gcloud beta run jobs update <JOB> --add-volume=name=<VOLUME_NAME>,type=ephemeral-disk,size=<SIZE> --add-volume-mount=volume=<VOLUME_NAME>,mount-path=<MOUNT_PATH>
```

```
gcloud beta run worker-pools update <WORKER_POOL> --add-volume=name=<VOLUME_NAME>,type=ephemeral-disk,size=<SIZE> --add-volume-mount=volume=<VOLUME_NAME>,mount-path=<MOUNT_PATH>
```

- why_it_matters: Deploy or update a Cloud Run service, job, or worker pool with an ephemeral-disk volume.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#56400_2026-04-07>, <https://docs.cloud.google.com/run/docs/configuring/services/ephemeral-disk>, <https://docs.cloud.google.com/sdk/gcloud/reference/run/jobs/update>, <https://docs.cloud.google.com/run/docs/configuring/workerpools/ephemeral-disk>, <https://docs.cloud.google.com/sdk/gcloud/reference/beta/run/jobs/create>, <https://docs.cloud.google.com/sdk/gcloud/reference/run/deploy>
- gotchas: "Availability: In beta."; "--add-volume (required): Adds a volume; repeat the flag to add more. Its value must include `type`; `name` is required when `mount-path` is omitted and optional when `mount-path` is specified."; "type (required): Set to `ephemeral-disk` for this volume type."; "name (required): Volume name; required if `mount-path` is omitted, otherwise optional."; "size: Disk space allocated to the volume; docs give `10Gi` or `100G` as examples. The ephemeral disk guide specifies 1Gi–100Gi."; "mount-path: Path at which the volume is mounted. For multi-container services, specify it under `--add-volume-mount`."; "--add-volume-mount (required): Adds a mount; value must include `volume=<NAME>` and `mount-path=<PATH>`."; "volume (required): Name of a volume on the resource to mount."; "mount-path (required): Path in the container filesystem where the volume is mounted."; "--execution-environment (required): For service ephemeral disks, set to `gen2`; ephemeral disks are only available in the second generation execution environment."; "Prerequisite: Install and initialize the gcloud CLI, update components, and enable billing for the project."; "Prerequisite: For services, required roles are Cloud Run Developer (`roles/run.developer`) on the service and Service Account User (`roles/iam.serviceAccountUser`) on the service identity."; "Prerequisite: Ephemeral disks require the second generation execution environment; each volume must be 1Gi–100Gi."; "Applies to volumes with `type=ephemeral-disk`."

### gcloud beta alloydb connect uses AlloyDB Auth Proxy and psql (2026-03-31)
- slug: gcloud-beta-alloydb-connect-uses-alloydb-auth-proxy-and-psql-16d84507dcc0
- score: 0.97

How to use it:

When you need an interactive connection to an AlloyDB instance, run `gcloud beta alloydb connect` with its instance, cluster, and region; it starts the AlloyDB Auth Proxy and `psql` session.

Examples:

```
gcloud beta alloydb connect <INSTANCE_ID> --cluster=<CLUSTER_ID> --region=<REGION_ID>
```

```
gcloud beta alloydb connect <INSTANCE_ID> --cluster=<CLUSTER_ID> --region=<REGION_ID> --public-ip
```

```
gcloud beta alloydb connect <INSTANCE_ID> --cluster=<CLUSTER_ID> --region=<REGION_ID> --auto-iam-authn
```

- why_it_matters: Connect to an AlloyDB instance from a coding workflow using the CLI.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#56300_2026-03-31>, <https://docs.cloud.google.com/alloydb/docs/connect-gcloud>, <https://docs.cloud.google.com/sdk/gcloud/reference/beta/alloydb/connect>
- gotchas: "Availability: beta"; "INSTANCE_ID (required): AlloyDB instance ID."; "--cluster=<CLUSTER_ID> (required): AlloyDB cluster ID."; "--region=<REGION_ID> (required): Regional location of the cluster."; "--database=<DATABASE> (-d): Database to connect to."; "--port=<PORT>: Local listener port for the Auth Proxy; default is 9471."; "--user=<USER> (-u): Built-in database user. Mutually exclusive with `--auto-iam-authn`."; "--auto-iam-authn: Enables Auto IAM authentication. Mutually exclusive with `--user`."; "--psc: Connect using Private Service Connect. Mutually exclusive with `--public-ip`."; "--public-ip: Connect using the instance's public IP. Mutually exclusive with `--psc`."; "Prerequisite: Install the gcloud CLI and the `psql` client tool."; "Prerequisite: The IAM principal needs the `roles/alloydb.client` role."; "Prerequisite: Have a network path to the instance; for example, run the command from a VPC that can reach it."

### GA network-security security-profile-groups update adds URL profile clearing (2026-03-24)
- slug: ga-network-security-security-profile-groups-update-adds-url-profile-clearing-3961ac798e82
- score: 0.91

How to use it:

When updating a security profile group's URL filtering profile, set `--url-filtering-profile` to the profile resource; to remove the configured profile, use `--clear-url-filtering-profile`. The two flags are mutually exclusive.

Examples:

```
gcloud network-security security-profile-groups update <GROUP> --organization=<ORG_ID> --location=global --url-filtering-profile=<URL_FILTERING_PROFILE>
```

```
gcloud network-security security-profile-groups update <GROUP> --organization=<ORG_ID> --location=global --clear-url-filtering-profile
```

- why_it_matters: Update a security profile group's URL filtering profile or clear it.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#56200_2026-03-24>, <https://docs.cloud.google.com/sdk/gcloud/reference/network-security/security-profile-groups/update>, <https://docs.cloud.google.com/network-security-integration/docs/configure-security-profile-groups>
- gotchas: "Availability: GA track"; "GROUP (required): Security profile group ID or fully qualified identifier."; "--organization (required): Organization ID for the security profile group."; "--location (required): Location ID for the security profile group."; "--url-filtering-profile: Sets the profile by ID or fully qualified identifier; required when using its resource location, organization, or project arguments."; "--url-filtering-profile-location: Location of the URL filtering profile; only global security profiles are supported."; "--url-filtering-profile-organization: Organization ID of the security profile."; "--url-filtering-profile-project: Project ID of the URL filtering profile."; "--clear-url-filtering-profile: Clears the URL filtering profile field. Mutually exclusive with the URL filtering profile resource argument group."; "Prerequisite: The update operation requires `networksecurity.securityProfileGroups.update` permission or the Security Profile Admin role (`networksecurity.securityProfileAdmin`) on the organization."; "The two flags are mutually exclusive."

### gcloud storage batch-operations jobs create adds storage-class rewriting (2026-03-24)
- slug: gcloud-storage-batch-operations-jobs-create-adds-storage-class-rewriting-bdf0378aaab4
- score: 0.94

How to use it:

When creating a batch job to rewrite object storage classes, use `--rewrite-object=storage-class=<STORAGE_CLASS>` with the job’s bucket and object-selection arguments.

Examples:

```
gcloud storage batch-operations jobs create <JOB_ID> --bucket=<BUCKET> --included-object-prefixes=<PREFIX> --rewrite-object=storage-class=<STORAGE_CLASS>
```

```
gcloud storage batch-operations jobs create <JOB_ID> --bucket=<BUCKET> --manifest-location=<MANIFEST_URI> --rewrite-object=storage-class=<STORAGE_CLASS>
```

- why_it_matters: Rewrite object storage classes in a batch-operations job.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#56200_2026-03-24>, <https://docs.cloud.google.com/sdk/gcloud/reference/storage/batch-operations/jobs/create>, <https://docs.cloud.google.com/storage/docs/batch-operations/create-manage-batch-operation-jobs>, <https://docs.cloud.google.com/storage/docs/changing-storage-classes>
- gotchas: "--rewrite-object=storage-class=<STORAGE_CLASS> (required): Rewrites objects to the specified class. Supported values: STANDARD, NEARLINE, COLDLINE, ARCHIVE. A metadata field must be specified."; "--bucket=<BUCKET> (required): Bucket containing the objects to process; use either this or `--bucket-list`."; "--included-object-prefixes=<PREFIX> (required): Selects objects by prefix; use this or `--manifest-location`."; "--manifest-location=<MANIFEST_URI> (required): Selects objects using a manifest; use this or `--included-object-prefixes`."; "Prerequisite: Configure Storage Intelligence on the bucket where the job will run."; "Prerequisite: For storage-class changes through rewrite, required permissions are `storage.objects.create`, `storage.objects.delete`, `storage.objects.get`, and `storage.objects.list`."

### Network Connectivity linked spokes support hybrid spoke filters (2026-03-24)
- slug: network-connectivity-linked-spokes-support-hybrid-spoke-filters-f0f6a35c3b37
- score: 0.96

How to use it:

When creating or updating a linked router appliance, interconnect attachment, or VPN tunnel spoke, set the include and exclude import/export range flags to filter routes. Supply only the ranges you need; on create, also provide the hub and linked resource arguments.

Examples:

```
gcloud network-connectivity spokes linked-router-appliances update <SPOKE> --region=<REGION> --include-import-ranges=<CIDR,...> --exclude-import-ranges=<CIDR,...> --include-export-ranges=<CIDR,...> --exclude-export-ranges=<CIDR,...>
```

```
gcloud network-connectivity spokes linked-interconnect-attachments create <SPOKE> --region=<REGION> --hub=<HUB> --interconnect-attachments=<ATTACHMENT_URI,...> --include-import-ranges=<CIDR,...> --exclude-import-ranges=<CIDR,...> --include-export-ranges=<CIDR,...> --exclude-export-ranges=<CIDR,...>
```

```
gcloud network-connectivity spokes linked-vpn-tunnels create <SPOKE> --region=<REGION> --hub=<HUB> --vpn-tunnels=<TUNNEL_URI,...> --include-import-ranges=<CIDR,...> --exclude-import-ranges=<CIDR,...> --include-export-ranges=<CIDR,...> --exclude-export-ranges=<CIDR,...>
```

- why_it_matters: Configure hybrid spoke filters for linked router appliances, interconnect attachments, or VPN tunnels.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#56200_2026-03-24>, <https://docs.cloud.google.com/sdk/gcloud/reference/network-connectivity/spokes/linked-router-appliances/update>, <https://docs.cloud.google.com/sdk/gcloud/reference/network-connectivity/spokes/linked-interconnect-attachments/create>, <https://docs.cloud.google.com/sdk/gcloud/reference/network-connectivity/spokes/linked-vpn-tunnels/create>, <https://docs.cloud.google.com/sdk/gcloud/reference/network-connectivity/spokes/linked-router-appliances/create>, <https://docs.cloud.google.com/network-connectivity/docs/network-connectivity-center/how-to/working-with-hubs-spokes>
- gotchas: "<SPOKE> (required): Spoke ID or fully qualified spoke identifier."; "--region (required): Spoke location; can be omitted if the spoke identifier is fully qualified."; "--hub (required): Hub for the new spoke; it must already exist."; "--interconnect-attachments (required): Existing VLAN attachment resources linked to the spoke."; "--vpn-tunnels (required): Existing HA VPN tunnel resources linked to the spoke."; "--include-import-ranges: Import hub routes fully encompassed by the ranges; empty means no hub subnets, with a site-to-site data transfer exception documented for IPv4 dynamic routes."; "--exclude-import-ranges: Exclude hub routes overlapped or encompassed by these ranges during import."; "--include-export-ranges: Export dynamic routes fully encompassed by these ranges; empty means export all dynamic routes."; "--exclude-export-ranges: Exclude dynamic routes overlapped or encompassed by these ranges during export."; "--router-appliance (required): On create, specify one or more router appliance instances and IP addresses; on update, optional and replaces the linked instance set when supplied."; "Prerequisite: For create commands, the hub and linked resources must already exist."; "Prerequisite: Updating spokes requires `networkconnectivity.spokes.update` permission; documented roles include Spoke Admin and Hub & Spoke Admin."; "The flags apply to the listed linked-router-appliances, linked-interconnect-attachments, and linked-vpn-tunnels create and update commands."

### gcloud filestore instances create accepts source-backup-project (2026-03-17)
- slug: gcloud-filestore-instances-create-accepts-source-backup-project-358cf28d7773
- score: 0.91

How to use it:

When restoring a Filestore instance from a backup in another project, set `source-backup-project` in `--file-share` to that backup’s project ID.

Examples:

```
gcloud filestore instances create <INSTANCE> --zone=<ZONE> --file-share=name=<SHARE_NAME>,capacity=<CAPACITY>,source-backup=<BACKUP_NAME>,source-backup-region=<BACKUP_REGION>,source-backup-project=<BACKUP_PROJECT> --network=name=<NETWORK>
```

- why_it_matters: Create a Filestore instance using a source backup project when the backup is in another project.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#56100_2026-03-17>, <https://docs.cloud.google.com/sdk/gcloud/reference/filestore/instances/create>
- gotchas: "INSTANCE (required): Instance ID or fully qualified identifier."; "--zone (required): Instance zone; location can also be set via documented alternatives such as `--region` or `--location`."; "--file-share.name (required): Desired logical name of the volume."; "--file-share.capacity (required): Desired volume capacity in GB or TB; GB is assumed if no unit is supplied."; "--file-share.source-backup: Name of the backup to restore from."; "--file-share.source-backup-region: Region of the source backup."; "--file-share.source-backup-project: Project of the source backup; defaults to the instance project if omitted."; "--network.name: VPC network name; `--network` is part of the command syntax, while the reference says its configuration options are optional."

### gcloud builds submit adds --publish for pack builds (2026-03-10)
- slug: gcloud-builds-submit-adds-publish-for-pack-builds-7e878e2c2a10
- score: 0.95

How to use it:

When building an image directly on Artifact Registry with buildpacks, submit the source with `gcloud builds submit --pack image=<LOCATION>-docker.pkg.dev/<PROJECT_ID>/<REPO_NAME>/<IMAGE_NAME>`. The documented command builds and uploads the image to the repository; the release note says `--publish` is for pack builds.

Examples:

```
gcloud builds submit --pack image=<LOCATION>-docker.pkg.dev/<PROJECT_ID>/<REPO_NAME>/<IMAGE_NAME>
```

- why_it_matters: Submit a pack build when building an image directly on Artifact Registry.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#56000_2026-03-10>, <https://docs.cloud.google.com/docs/buildpacks/build-application>, <https://docs.cloud.google.com/sdk/gcloud/reference/builds/submit>
- gotchas: "--pack (required): Selects the CNCF buildpack build; `image` is required. `builder` and `env` are optional. Mutually exclusive with `--config` and `--tag`."; "--pack image (required): Image name must use the `gcr.io` or `pkg.dev` namespace. For Artifact Registry, use `<LOCATION>-docker.pkg.dev/<PROJECT_ID>/<REPO_NAME>/<IMAGE_NAME>`."; "--pack builder: Optional custom builder image; defaults to `gcr.io/buildpacks/builder`."; "--pack env: Optional environment variables passed to the builder as a list of key-values."; "--publish: The release note says this flag was added to `gcloud builds submit` for pack builds to build images directly on Artifact Registry instead of local Docker. The current command reference does not document this flag."; "Prerequisite: Install and initialize the Google Cloud CLI; enable the Cloud Build and Artifact Registry APIs; have billing enabled and access to a container image repository."; "Prerequisite: Use an Artifact Registry Docker repository and an image name in the `<LOCATION>-docker.pkg.dev/<PROJECT_ID>/<REPO_NAME>/<IMAGE_NAME>` form."; "`--publish` is for pack builds."; "Docs conflict: Current `gcloud builds submit` reference and buildpacks guide do not document `--publish`; release note states it was added for pack builds. The documented current example omits the flag, so an invocation including it cannot be verified from the command reference."

### gcloud container node-pools create and update accept --consolidation-delay (2026-03-03)
- slug: gcloud-container-node-pools-create-and-update-accept-consolidation-delay-1cab26063087
- score: 0.92

How to use it:

When creating or updating a GKE node pool, set `--consolidation-delay` to the duration after which the Cluster Autoscaler can scale down underutilized nodes.

Examples:

```
gcloud container node-pools create <pool> --cluster=<cluster> --consolidation-delay=3600s
```

```
gcloud container node-pools update <pool> --cluster=<cluster> --consolidation-delay=3600s
```

- why_it_matters: Control when the Cluster Autoscaler can scale down underutilized nodes in a node pool.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#55900_2026-03-03>, <https://docs.cloud.google.com/sdk/gcloud/reference/container/node-pools/create>, <https://docs.cloud.google.com/sdk/gcloud/reference/container/node-pools/update>
- gotchas: "NAME (`<pool>`) (required): Node pool name."; "--cluster (`<cluster>`): Cluster to add the pool to or update; overrides the command's `container/cluster` property."; "--consolidation-delay (`<duration>`): Duration after which the Cluster Autoscaler can scale down underutilized nodes; example value: `3600s`."; "Prerequisite: The create command creates a node pool in a running GKE cluster; update changes a node pool in a running cluster."; "The flag controls when the Cluster Autoscaler can scale down underutilized nodes."

### gcloud beta vector-search data-objects search adds dense ScaNN parameters (2026-02-24)
- slug: gcloud-beta-vector-search-data-objects-search-adds-dense-scann-parameters-e6f4ca0937ac
- score: 0.96

How to use it:

For dense vector search using an index, pass the ScaNN tuning flags to `gcloud beta vector-search collections data-objects search`. Supply either flag or both; do not combine them with `--dense-scann-target-recall`.

Examples:

```
gcloud beta vector-search collections data-objects search --collection=<collection> --location=<location> --vector-search-field=<vector-field> --vector-from-file=<vector.json> --use-index=<index> --dense-scann-search-leaves-pct=<percentage> --dense-scann-initial-candidate-count=<candidate-count>
```

- why_it_matters: Search Vector Search data objects using dense ScaNN parameters.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#55800_2026-02-24>, <https://docs.cloud.google.com/sdk/gcloud/reference/beta/vector-search/collections/data-objects/search>
- gotchas: "Availability: beta"; "--collection (required): Collection to search data objects from."; "--location (required): Location of the collection."; "--vector-search-field (required): Vector field to search; required for vector search."; "--vector-from-file (required): Path to a JSON file containing the dense or sparse query vector; required for vector search."; "--use-index (required): Index resource name or ID; required when specifying Dense ScaNN tuning flags."; "--dense-scann-search-leaves-pct: Percentage of leaves to search for dense ScaNN, in the range [0, 100]. Can be used with `--dense-scann-initial-candidate-count`; cannot be combined with `--dense-scann-target-recall`."; "--dense-scann-initial-candidate-count: Number of initial candidates for dense ScaNN. Can be used with `--dense-scann-search-leaves-pct`; cannot be combined with `--dense-scann-target-recall`."; "--dense-scann-target-recall: Query-time target recall for dense ScaNN, a value in [0, 1]; mutually exclusive with either low-level Dense ScaNN override."

### gcloud compute machine-images create accepts --resource-manager-tags in v1 (2026-02-10)
- slug: gcloud-compute-machine-images-create-accepts-resource-manager-tags-in-v1-9784c0be81d1
- score: 0.93

How to use it:

To create a machine image from an instance with Resource Manager tags, run `gcloud compute machine-images create` with the image name, source instance, and `--resource-manager-tags=KEY=VALUE`.

Examples:

```
gcloud compute machine-images create <image> --source-instance=<source-instance> --resource-manager-tags=<key>=<value>
```

- why_it_matters: Create a Compute Engine machine image with Resource Manager tags.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#55600_2026-02-10>, <https://docs.cloud.google.com/sdk/gcloud/reference/compute/machine-images/create>
- gotchas: "Version: v1"; "IMAGE (required): Name of the machine image to create."; "--source-instance (required): Source instance for the machine image."; "--resource-manager-tags: Comma-separated Resource Manager tags to apply to the machine image, in `KEY=VALUE` form."

### gcloud container clusters commands accept --autopilot-general-profile (2026-02-10)
- slug: gcloud-container-clusters-commands-accept-autopilot-general-profile-b6a45fcd394f
- score: 0.93

How to use it:

For GKE clusters running version 1.32 or later, set the Autopilot general profile by passing `--autopilot-general-profile=none` or `--autopilot-general-profile=no-performance` to a supported cluster command.

Examples:

```
gcloud container clusters create <cluster-name> --autopilot-general-profile=<none|no-performance>
```

```
gcloud container clusters create-auto <cluster-name> --autopilot-general-profile=<none|no-performance>
```

```
gcloud container clusters update <cluster-name> --autopilot-general-profile=<none|no-performance>
```

- why_it_matters: Set the Autopilot general compute profile when creating or updating a supported GKE cluster.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#55600_2026-02-10>, <https://docs.cloud.google.com/sdk/gcloud/reference/container/clusters/create>, <https://docs.cloud.google.com/sdk/gcloud/reference/container/clusters/create-auto>, <https://docs.cloud.google.com/sdk/gcloud/reference/container/clusters/update>, <https://docs.cloud.google.com/kubernetes-engine/docs/concepts/autopilot-overview>, <https://docs.cloud.google.com/sdk/release-notes#55600_2026-02-10>
- gotchas: "--autopilot-general-profile: Sets the cluster's Autopilot general profile."; "none: Uses the Autopilot default configuration."; "no-performance: Turns off proactive capacity provisioning; this reduces provisioning performance for general-purpose workloads."; "<cluster-name> / NAME (required): Name of the cluster to create or update."; "Prerequisite: The cluster must run version 1.32 or later."; "Available on clusters running version 1.32 or later."; "Accepted values are `none` and `no-performance`."

### gcloud network-management connectivity-tests supports GKE Pod endpoints (2026-02-03)
- slug: gcloud-network-management-connectivity-tests-supports-gke-pod-endpoints-614eb5179dbc
- score: 0.95

How to use it:

When debugging connectivity to or from a GKE Pod, create a Connectivity Test with the Pod URI in `--source-gke-pod` or `--destination-gke-pod`.

Examples:

```
gcloud network-management connectivity-tests create <test-name> --protocol=<protocol> --source-gke-pod=<source-pod-uri> --destination-gke-pod=<destination-pod-uri> --destination-port=<port> --round-trip
```

- why_it_matters: Run a Connectivity Test to or from a GKE Pod while debugging repository connectivity.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#55500_2026-02-03>, <https://docs.cloud.google.com/network-intelligence-center/docs/connectivity-tests/how-to/running-connectivity-tests>, <https://docs.cloud.google.com/sdk/gcloud/reference/network-management/connectivity-tests/create>, <https://docs.cloud.google.com/network-intelligence-center/docs/connectivity-tests/concepts/access-control>
- gotchas: "<test-name> (required): Connectivity Test name."; "--source-gke-pod=<source-pod-uri>: GKE Pod URI for the source endpoint. Required when the source is a Pod; at least one endpoint flag must be specified."; "--destination-gke-pod=<destination-pod-uri>: GKE Pod URI for the destination endpoint. Required when the destination is a Pod; at least one endpoint flag must be specified."; "--protocol=<protocol>: Protocol for the test; defaults to TCP."; "--destination-port=<port>: Destination port; specify only for TCP or UDP tests."; "--round-trip: Also calculate return traces if the packet reaches the destination."; "Prerequisite: Use the Google Cloud CLI. The caller needs permission to create Connectivity Tests and at least `roles/compute.networkViewer` to read the tested network configuration."; "The Pod flags apply to Connectivity Tests to or from GKE Pods."

### gcloud sql users assign-roles grants or revokes database roles (2026-02-03)
- slug: gcloud-sql-users-assign-roles-grants-or-revokes-database-roles-b7caae8c5150
- score: 0.98

How to use it:

For a Cloud SQL MySQL or PostgreSQL user, use `gcloud sql users assign-roles` to grant roles; add `--revoke-existing-roles` to replace existing roles, or pass an empty `--database-roles` value with it to revoke all roles.

Examples:

```
gcloud sql users assign-roles <USERNAME> --instance=<INSTANCE> --database-roles=<ROLE_1>,<ROLE_2> --type=BUILT_IN
```

```
gcloud sql users assign-roles <USERNAME> --instance=<INSTANCE> --revoke-existing-roles --database-roles=<ROLE_1>,<ROLE_2> --type=BUILT_IN
```

```
gcloud sql users assign-roles <USERNAME> --type=BUILT_IN --instance=<INSTANCE> --database-roles= --revoke-existing-roles
```

- why_it_matters: Grant or revoke roles for a Postgres or MySQL user in Cloud SQL.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#55500_2026-02-03>, <https://docs.cloud.google.com/sdk/gcloud/reference/sql/users/assign-roles>, <https://docs.cloud.google.com/sql/docs/postgres/create-manage-users>
- gotchas: "USERNAME (required): Cloud SQL username."; "--instance (-i) (required): Cloud SQL instance ID."; "--type (required): Cloud SQL user type; determines login authentication method. `BUILT_IN` represents a built-in user."; "--database-roles: Comma-separated roles to assign; available for MySQL and PostgreSQL. May be empty when revoking all roles."; "--revoke-existing-roles: Revoke the user's existing database roles; available for MySQL and PostgreSQL. Used with `--database-roles` to replace roles, or with an empty value to revoke all."; "--host: User hostname as an IP address, address range, or `%`; applies to MySQL and is ignored for other engines."; "Prerequisite: Custom roles must already exist in the database; create them with `CREATE ROLE` before assigning them."; "Applies to Postgres and MySQL users."

### gcloud sql users create accepts --database-roles (2026-02-03)
- slug: gcloud-sql-users-create-accepts-database-roles-bc8ca857e1b1
- score: 0.95

How to use it:

For a Cloud SQL MySQL or PostgreSQL instance, create a user with `gcloud sql users create` and pass `--database-roles` to assign roles during creation.

Examples:

```
gcloud sql users create <USERNAME> --instance=<INSTANCE> --database-roles=<ROLE_1>,<ROLE_2>
```

- why_it_matters: Create a Postgres or MySQL user with additional database roles.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#55500_2026-02-03>, <https://docs.cloud.google.com/sdk/gcloud/reference/sql/users/create>
- gotchas: "USERNAME (required): Cloud SQL username."; "--instance=INSTANCE (required): Cloud SQL instance ID."; "--database-roles=ROLE,…: Comma-separated roles to assign; available only for MySQL and PostgreSQL instances. Roles can be predefined or custom."; "Prerequisite: Any custom roles must already exist in the database; create them with `CREATE ROLE`."; "Applies to Postgres and MySQL."

### gcloud dataflow yaml run supports additional pipeline flags (2026-01-27)
- slug: gcloud-dataflow-yaml-run-supports-additional-pipeline-flags-be867e772dc8
- score: 0.94

How to use it:

When configuring a Dataflow YAML job, run `gcloud dataflow yaml run` with a job name, exactly one YAML source, and any needed additional flags.

Examples:

```
gcloud dataflow yaml run <JOB_NAME> --yaml-pipeline-file=gs://<BUCKET>/<PATH> --region=<REGION> --additional-pipeline-options=option1=value1,option2=value2 --additional-experiments=experiment1,experiment2=value2 --additional-user-labels='key1=value1,key2=value2' --num-workers=<COUNT> --max-workers=<COUNT> --worker-machine-type=<MACHINE_TYPE> --launcher-machine-type=<MACHINE_TYPE> --temp-location=gs://<BUCKET>/<TEMP_PATH> --staging-location=gs://<BUCKET>/<STAGING_PATH> --dataflow-kms-key=<KMS_KEY> --disable-public-ips --enable-streaming-engine --update --transform-name-mappings=<MAPPINGS>
```

```
gcloud dataflow yaml run <JOB_NAME> --yaml-pipeline='<INLINE_YAML>' --region=<REGION>
```

- why_it_matters: Configure a Dataflow YAML pipeline run with additional pipeline settings.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#55400_2026-01-27>, <https://docs.cloud.google.com/sdk/gcloud/reference/dataflow/yaml/run>, <https://docs.cloud.google.com/dataflow/docs/reference/pipeline-options>
- gotchas: "JOB_NAME (required): Unique name to assign to the job."; "--yaml-pipeline / --yaml-pipeline-file (required): Exactly one is required. Inline pipeline definition, or local/gs:// file path defining the pipeline."; "--additional-experiments: Comma-separated additional experiments to pass to the job."; "--additional-pipeline-options: Comma-separated additional pipeline options; available options are listed in the Dataflow pipeline options reference."; "--additional-user-labels: Comma-separated key=value user labels."; "--disable-public-ips: Run workers without public IP addresses; overrides the command's default property value."; "--temp-location: Cloud Storage location for temporary files; defaults to --staging-location if unset, and must start with gs://."; "--staging-location: Cloud Storage location for staging local files; defaults to --temp-location if unset, and must start with gs://."; "--num-workers: Initial number of workers."; "--max-workers: Maximum number of workers."; "--worker-machine-type: Worker machine type; defaults to a server-selected type."; "--launcher-machine-type: Machine type for launching the job; defaults to a Dataflow-selected type."; "--dataflow-kms-key: Cloud KMS key to protect job resources."; "--enable-streaming-engine: Enable Streaming Engine for a streaming job; overrides the command's default property value."; "--update: Enable updating a streaming job; the flag also supports --no-update to disable it."; "--transform-name-mappings: Transform name mappings for a streaming update job."; "--region: Job regional endpoint; defaults to us-central1."; "Prerequisite: Specify exactly one pipeline source: --yaml-pipeline or --yaml-pipeline-file."; "Prerequisite: For Dataflow pipeline execution, specify at least one of temp_location or staging_location; this command lets either location default to the other."

### gcloud dataproc clusters create can exclude auto-placement zones (2026-01-21)
- slug: gcloud-dataproc-clusters-create-can-exclude-auto-placement-zones-ab532707e95f
- score: 0.91

How to use it:

When creating a Dataproc cluster with automatic zone selection, pass `--auto-zone-exclude-zones` with the comma-separated zones to exclude.

Examples:

```
gcloud dataproc clusters create <cluster-name> --region=<region> --auto-zone-exclude-zones=<zone-1>,<zone-2>
```

- why_it_matters: Create a Dataproc cluster with auto zone placement while excluding specified zones.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#55300_2026-01-21>, <https://docs.cloud.google.com/sdk/gcloud/reference/dataproc/clusters/create>
- gotchas: "CLUSTER (required): Cluster name."; "--region (required): Region for the cluster; Auto Zone placement selects a zone when no zone is specified and region is not global."; "--auto-zone-exclude-zones: Comma-separated compute zones to exclude when Auto Zone placement picks the cluster zone. Use with automatic zone placement; the command docs list it in the zone-selection group alongside `--multizone`, or `--zone` as a mutually exclusive alternative."; "The exclusion applies when using auto zone placement."

### gcloud spanner instances adds total CPU based autoscaling flags (2026-01-06)
- slug: gcloud-spanner-instances-adds-total-cpu-based-autoscaling-flags-bdae58b7fa4f
- score: 0.95

How to use it:

When configuring managed autoscaling for a Spanner instance, set `--autoscaling-total-cpu-target` with the required autoscaling limits and storage target. Use `gcloud spanner instances create` to create an instance or `gcloud spanner instances update` to configure an existing one.

Examples:

```
gcloud spanner instances create <instance-id> --config=<instance-config> --description=<description> --autoscaling-min-nodes=<min-nodes> --autoscaling-max-nodes=<max-nodes> --autoscaling-total-cpu-target=<total-cpu-percent> --autoscaling-storage-target=<storage-percent>
```

```
gcloud spanner instances update <instance-id> --autoscaling-min-nodes=<min-nodes> --autoscaling-max-nodes=<max-nodes> --autoscaling-total-cpu-target=<total-cpu-percent> --autoscaling-storage-target=<storage-percent>
```

- why_it_matters: Configure total CPU based autoscaling for Spanner instances.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#55100_2026-01-06>, <https://docs.cloud.google.com/sdk/gcloud/reference/spanner/instances/create>, <https://docs.cloud.google.com/sdk/gcloud/reference/spanner/instances/update>, <https://docs.cloud.google.com/spanner/docs/create-manage-instances>
- gotchas: "Availability: beta and GA"; "INSTANCE (required): Cloud Spanner instance ID."; "--config (required): Instance configuration; defines geographic placement and replication."; "--description (required): Instance description."; "--autoscaling-total-cpu-target (required): Target percentage of total CPU the autoscaled instance can utilize. At least one CPU target must be specified; the documented target range is 10–90%."; "--autoscaling-storage-target (required): Target percentage of storage for the autoscaled instance; required when other autoscaling arguments are specified."; "--autoscaling-min-nodes (required): Minimum node count for autoscaling. Specify this and max nodes, or use the processing-unit limits instead; the two limit units are mutually exclusive."; "--autoscaling-max-nodes (required): Maximum node count for autoscaling. Specify this and min nodes, or use the processing-unit limits instead; the two limit units are mutually exclusive."; "--autoscaling-min-processing-units (required): Minimum processing units for autoscaling. Use with max processing units instead of node limits; the two limit units are mutually exclusive."; "--autoscaling-max-processing-units (required): Maximum processing units for autoscaling. Use with min processing units instead of node limits; the two limit units are mutually exclusive."; "--autoscaling-high-priority-cpu-target: Target percentage of high-priority CPU; may be specified alongside the total CPU target."; "--asymmetric-autoscaling-option.location (required): Location of the read-only region to scale asymmetrically; required when using this option."; "--asymmetric-autoscaling-option.min_nodes: Minimum nodes for asymmetric autoscaling; otherwise inherited from the base instance configuration."; "--asymmetric-autoscaling-option.max_nodes: Maximum nodes for asymmetric autoscaling; otherwise inherited from the base instance configuration."; "--asymmetric-autoscaling-option.min_processing_units: Minimum processing units for asymmetric autoscaling."; "--asymmetric-autoscaling-option.max_processing_units: Maximum processing units for asymmetric autoscaling."; "--asymmetric-autoscaling-option.total_cpu_target: Total CPU target for asymmetric autoscaling; documented range is 10–90%."; "--asymmetric-autoscaling-option.high_priority_cpu_target: High-priority CPU target for asymmetric autoscaling."; "--asymmetric-autoscaling-option.disable_total_cpu_autoscaling: Set TRUE to disable total CPU autoscaling for the replica; cannot disable both total CPU and high-priority CPU autoscaling on the same replica."; "--asymmetric-autoscaling-option.disable_high_priority_cpu_autoscaling: Set TRUE to disable high-priority CPU autoscaling for the replica; cannot disable both total CPU and high-priority CPU autoscaling on the same replica."; "Prerequisite: The managed autoscaler create examples are for Enterprise and Enterprise Plus edition instances."; "Prerequisite: For creation, provide `--config` and `--description`; managed autoscaling requires storage target, limits in nodes or processing units, and at least one CPU target."

### gcloud workstations configs adds disk configuration and Hyperdisk support (2026-01-06)
- slug: gcloud-workstations-configs-adds-disk-configuration-and-hyperdisk-support-9e4e2823593b
- score: 0.94

How to use it:

When creating or updating a Workstations config, set disk options with the `--disk-*` flags; choose `hyperdisk-balanced-ha` for Hyperdisk. The current update reference omits `--disk-reclaim-policy`, which conflicts with the release note.

Examples:

```
gcloud workstations configs create <CONFIG> --cluster=<CLUSTER> --region=<REGION> --disk-type=hyperdisk-balanced-ha --disk-size=<10|50|100|200|500|1000> --disk-reclaim-policy=<delete|retain>
```

```
gcloud workstations configs update <CONFIG> --cluster=<CLUSTER> --region=<REGION> --disk-type=hyperdisk-balanced-ha --disk-size=<10|50|100|200|500|1000>
```

```
gcloud workstations configs update <CONFIG> --cluster=<CLUSTER> --region=<REGION> --disk-source-snapshot=<SNAPSHOT>
```

- why_it_matters: Configure workstation disks when creating or updating a Workstations config.
- sources: <https://docs.cloud.google.com/sdk/docs/release-notes#55100_2026-01-06>, <https://docs.cloud.google.com/sdk/gcloud/reference/workstations/configs/create>, <https://docs.cloud.google.com/sdk/gcloud/reference/workstations/configs/update>
- gotchas: "CONFIG (required): Configuration ID; `--cluster` and `--region` are required resource attributes."; "--cluster (required): Cluster for the config."; "--region (required): Region for the config."; "--disk-type: Persistent directory disk type: `pd-standard`, `pd-balanced`, `pd-ssd`, or `hyperdisk-balanced-ha`."; "--disk-size: Persistent directory size in GB: `10`, `50`, `100`, `200`, `500`, or `1000`. On update, specified together with `--disk-type`."; "--disk-reclaim-policy: On create, controls deletion behavior: `delete` (default) or `retain`. The current update reference does not document this flag."; "--disk-source-snapshot: Snapshot name used as the source for the home disk. Update documentation lists it as an alternative to the disk size/type pair."; "--disk-size` + `--disk-type` / `--disk-source-snapshot: Update syntax presents the size/type pair and source-snapshot flag as alternatives; do not specify both alternatives together."; "Docs conflict: Release note says `--disk-reclaim-policy` was added to `gcloud workstations configs update`; the current official update reference does not list or describe that flag, so its update usage and behavior are unverified."