@pulumi/gcp 9.12.0 → 9.13.0

package/types/output.d.ts

@@ -536,6 +536,42 @@ export declare namespace accesscontextmanager {
          */
         useOidcMaxAge?: boolean;
     }
+    interface GetSupportedServiceSupportedMethod {
+        /**
+         * A valid method name for the respective request mode. Must be a fully qualified name, for example, `storage.googleapis.com/BucketService.GetBucket`.
+         */
+        method: string;
+        /**
+         * A valid Cloud IAM permission for the respective request mode, for example, `storage.buckets.get`.
+         */
+        permission: string;
+    }
+    interface GetSupportedServicesSupportedService {
+        /**
+         * True if the service is available on the restricted VIP. Services on the restricted VIP typically either support VPC Service Controls or are core infrastructure services required for the functioning of Google Cloud.
+         */
+        availableOnRestrictedVip: boolean;
+        /**
+         * True if the service is supported with some limitations. Check [documentation](https://cloud.google.com/vpc-service-controls/docs/supported-products) for details.
+         */
+        knownLimitations: boolean;
+        /**
+         * The service name or address of the supported service, such as `storage.googleapis.com`.
+         */
+        name: string;
+        /**
+         * The support stage of the service. Values are `GA`, `PREVIEW`, and `DEPRECATED`.
+         */
+        serviceSupportStage: string;
+        /**
+         * The support stage of the service.
+         */
+        supportStage: string;
+        /**
+         * The name of the supported product, such as 'Cloud Storage'.
+         */
+        title: string;
+    }
     interface ServicePerimeterDryRunEgressPolicyEgressFrom {
         /**
          * Identities can be an individual user, service account, Google group,
@@ -2358,6 +2394,19 @@ export declare namespace alloydb {
          * **Note**: This property is sensitive and will not be displayed in the plan.
          */
         password?: string;
+        /**
+         * **NOTE:** This field is write-only and its value will not be updated in state as part of read operations.
+         * (Optional, Write-Only)
+         * The initial password for the user.
+         * **Note**: This property is write-only and will not be read from the API.
+         *
+         * > **Note:** One of `password` or `passwordWo` can only be set.
+         */
+        passwordWo?: string;
+        /**
+         * Triggers update of `passwordWo` write-only. Increment this value when an update to `passwordWo` is needed. For more info see [updating write-only arguments](https://www.terraform.io/docs/providers/google/guides/using_write_only_arguments.html#updating-write-only-arguments)
+         */
+        passwordWoVersion?: string;
         /**
          * The database username.
          */
@@ -2666,6 +2715,14 @@ export declare namespace alloydb {
          * The initial password for the user.
          */
         password: string;
+        /**
+         * The initial password for the user.
+         */
+        passwordWo: string;
+        /**
+         * Triggers update of 'password_wo' write-only. Increment this value when an update to 'password_wo' is needed. For more info see [updating write-only arguments](https://www.terraform.io/docs/providers/google/guides/using_write_only_arguments.html#updating-write-only-arguments)
+         */
+        passwordWoVersion: string;
         /**
          * The database username.
          */
@@ -2820,6 +2877,17 @@ export declare namespace alloydb {
          * Whether to enabled Managed Connection Pool.
          */
         enabled: boolean;
+        /**
+         * Flags for configuring managed connection pooling when it is enabled.
+         * These flags will only be set if 'connection_pool_config.enabled' is
+         * true.
+         * Please see
+         * https://cloud.google.com/alloydb/docs/configure-managed-connection-pooling#configuration-options
+         * for a comprehensive list of flags that can be set. To specify the flags
+         * in Terraform, please remove the "connection-pooling-" prefix and use
+         * underscores instead of dashes in the name. For example,
+         * "connection-pooling-pool-mode" would be "poolMode".
+         */
         flags: {
             [key: string]: string;
         };
@@ -3094,6 +3162,17 @@ export declare namespace alloydb {
          * Whether to enabled Managed Connection Pool.
          */
         enabled: boolean;
+        /**
+         * Flags for configuring managed connection pooling when it is enabled.
+         * These flags will only be set if `connection_pool_config.enabled` is
+         * true.
+         * Please see
+         * https://cloud.google.com/alloydb/docs/configure-managed-connection-pooling#configuration-options
+         * for a comprehensive list of flags that can be set. To specify the flags
+         * in Terraform, please remove the "connection-pooling-" prefix and use
+         * underscores instead of dashes in the name. For example,
+         * "connection-pooling-pool-mode" would be "poolMode".
+         */
         flags?: {
             [key: string]: string;
         };
@@ -7593,7 +7672,7 @@ export declare namespace backupdisasterrecovery {
         location: string;
         /**
          * The type of the Google Cloud resource. Use the Unified Resource Type,
-         * 						eg. compute.googleapis.com/Instance.
+         * 					eg. compute.googleapis.com/Instance.
          */
         type: string;
     }
@@ -7650,6 +7729,206 @@ export declare namespace backupdisasterrecovery {
          */
         resourceType: string;
     }
+    interface GetDataSourcesDataSource {
+        /**
+         * Details of how the resource is configured for backup.
+         */
+        backupConfigInfos: outputs.backupdisasterrecovery.GetDataSourcesDataSourceBackupConfigInfo[];
+        /**
+         * Number of backups in the data source.
+         */
+        backupCount: string;
+        /**
+         * The backup configuration state.
+         */
+        configState: string;
+        /**
+         * The time when the instance was created.
+         */
+        createTime: string;
+        /**
+         * The backed up resource is a backup appliance application.
+         */
+        dataSourceBackupApplianceApplications: outputs.backupdisasterrecovery.GetDataSourcesDataSourceDataSourceBackupApplianceApplication[];
+        /**
+         * The backed up resource is a Google Cloud resource.
+         * 		The word 'DataSource' was included in the names to indicate that this is
+         * 		the representation of the Google Cloud resource used within the
+         * 		DataSource object.
+         */
+        dataSourceGcpResources: outputs.backupdisasterrecovery.GetDataSourcesDataSourceDataSourceGcpResource[];
+        /**
+         * Server specified ETag for the ManagementServer resource to prevent simultaneous updates from overwiting each other.
+         */
+        etag: string;
+        /**
+         * Resource labels to represent user provided metadata.
+         */
+        labels: {
+            [key: string]: string;
+        };
+        /**
+         * Name of the datasource to create.
+         * 		It must have the format "projects/{project}/locations/{location}/backupVaults/{backupvault}/dataSources/{datasource}".
+         * 		'{datasource}' cannot be changed after creation. It must be between 3-63 characters long and must be unique within the backup vault.
+         */
+        name: string;
+        /**
+         * The DataSource resource instance state.
+         */
+        state: string;
+        /**
+         * The number of bytes (metadata and data) stored in this datasource.
+         */
+        totalStoredBytes: string;
+        /**
+         * The time when the instance was updated.
+         */
+        updateTime: string;
+    }
+    interface GetDataSourcesDataSourceBackupConfigInfo {
+        /**
+         * Configuration for an application backed up by a Backup Appliance.
+         */
+        backupApplianceBackupConfigs: outputs.backupdisasterrecovery.GetDataSourcesDataSourceBackupConfigInfoBackupApplianceBackupConfig[];
+        /**
+         * Configuration for a Google Cloud resource.
+         */
+        gcpBackupConfigs: outputs.backupdisasterrecovery.GetDataSourcesDataSourceBackupConfigInfoGcpBackupConfig[];
+        /**
+         * If the last backup failed, this field has the error message.
+         */
+        lastBackupError: {
+            [key: string]: string;
+        };
+        /**
+         * LastBackupstate tracks whether the last backup was not yet started, successful, failed, or could not be run because of the lack of permissions.
+         */
+        lastBackupState: string;
+        /**
+         * If the last backup were successful, this field has the consistency date.
+         */
+        lastSuccessfulBackupConsistencyTime: string;
+    }
+    interface GetDataSourcesDataSourceBackupConfigInfoBackupApplianceBackupConfig {
+        /**
+         * The name of the application.
+         */
+        applicationName: string;
+        /**
+         * The ID of the backup appliance.
+         */
+        backupApplianceId: string;
+        /**
+         * The name of the backup appliance.
+         */
+        backupApplianceName: string;
+        /**
+         * The name of the host where the application is running.
+         */
+        hostName: string;
+        /**
+         * The ID of the SLA of this application.
+         */
+        slaId: string;
+        /**
+         * The name of the SLP associated with the application.
+         */
+        slpName: string;
+        /**
+         * The name of the SLT associated with the application.
+         */
+        sltName: string;
+    }
+    interface GetDataSourcesDataSourceBackupConfigInfoGcpBackupConfig {
+        /**
+         * The name of the backup plan.
+         */
+        backupPlan: string;
+        /**
+         * The name of the backup plan association.
+         */
+        backupPlanAssociation: string;
+        /**
+         * The description of the backup plan.
+         */
+        backupPlanDescription: string;
+        /**
+         * The names of the backup plan rules which point to this backupvault
+         */
+        backupPlanRules: string[];
+    }
+    interface GetDataSourcesDataSourceDataSourceBackupApplianceApplication {
+        /**
+         * Appliance Id of the Backup Appliance.
+         */
+        applianceId: string;
+        /**
+         * The appid field of the application within the Backup Appliance.
+         */
+        applicationId: string;
+        /**
+         * The name of the Application as known to the Backup Appliance.
+         */
+        applicationName: string;
+        /**
+         * Appliance name.
+         */
+        backupAppliance: string;
+        /**
+         * Hostid of the application host.
+         */
+        hostId: string;
+        /**
+         * Hostname of the host where the application is running.
+         */
+        hostname: string;
+        /**
+         * The type of the application. e.g. VMBackup
+         */
+        type: string;
+    }
+    interface GetDataSourcesDataSourceDataSourceGcpResource {
+        /**
+         * ComputeInstanceDataSourceProperties has a subset of Compute Instance properties that are useful at the Datasource level.
+         */
+        computeInstanceDataSourceProperties: outputs.backupdisasterrecovery.GetDataSourcesDataSourceDataSourceGcpResourceComputeInstanceDataSourceProperty[];
+        /**
+         * Full resource pathname URL of the source Google Cloud resource.
+         */
+        gcpResourcename: string;
+        /**
+         * Location of the resource: <region>/<zone>/"global"/"unspecified".
+         */
+        location: string;
+        /**
+         * The type of the Google Cloud resource. Use the Unified Resource Type,
+         * 					eg. compute.googleapis.com/Instance.
+         */
+        type: string;
+    }
+    interface GetDataSourcesDataSourceDataSourceGcpResourceComputeInstanceDataSourceProperty {
+        /**
+         * The description of the Compute Engine instance.
+         */
+        description: string;
+        /**
+         * The machine type of the instance.
+         */
+        machineType: string;
+        /**
+         * Name of the compute instance backed up by the datasource.
+         */
+        name: string;
+        /**
+         * The total number of disks attached to the Instance.
+         */
+        totalDiskCount: string;
+        /**
+         * The sum of all the disk sizes.
+         */
+        totalDiskSizeGb: string;
+    }
     interface GetManagementServerManagementUri {
         /**
          * The management console api endpoint.
@@ -8136,7 +8415,10 @@ export declare namespace backupdisasterrecovery {
          */
         externalIpv6PrefixLength?: number;
         /**
-         * Required. The resource name of the backup instance.
+         * (Optional, Deprecated)
+         * The resource name of the backup instance.
+         *
+         * > **Warning:** `name` is deprecated and will be removed in a future major release. The backup is identified by the parameters (location, backup_vault_id, data_source_id, backup_id).
          */
         name?: string;
         /**
@@ -8676,6 +8958,13 @@ export declare namespace beyondcorp {
         ports: number[];
     }
     interface SecurityGatewayApplicationIamBindingCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -8687,6 +8976,13 @@ export declare namespace beyondcorp {
         title: string;
     }
     interface SecurityGatewayApplicationIamMemberCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -8841,6 +9137,13 @@ export declare namespace beyondcorp {
         assignedIps: string[];
     }
     interface SecurityGatewayIamBindingCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -8852,6 +9155,13 @@ export declare namespace beyondcorp {
         title: string;
     }
     interface SecurityGatewayIamMemberCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -8993,6 +9303,16 @@ export declare namespace biglake {
          */
         state: string;
     }
+    interface IcebergNamespaceIamBindingCondition {
+        description?: string;
+        expression: string;
+        title: string;
+    }
+    interface IcebergNamespaceIamMemberCondition {
+        description?: string;
+        expression: string;
+        title: string;
+    }
     interface TableHiveOptions {
         /**
          * Stores user supplied Hive table parameters. An object containing a
@@ -9273,11 +9593,16 @@ export declare namespace bigquery {
     interface DataTransferConfigSensitiveParams {
         /**
          * The Secret Access Key of the AWS account transferring data from.
+         * **Note**: This property is sensitive and will not be displayed in the plan.
          */
         secretAccessKey?: string;
         /**
          * **NOTE:** This field is write-only and its value will not be updated in state as part of read operations.
+         * (Optional, Write-Only)
          * The Secret Access Key of the AWS account transferring data from.
+         * **Note**: This property is write-only and will not be read from the API.
+         *
+         * > **Note:** One of `secretAccessKey` or `secretAccessKeyWo` can only be set.
          */
         secretAccessKeyWo?: string;
         /**
@@ -9513,6 +9838,13 @@ export declare namespace bigquery {
         externalSource: string;
     }
     interface DatasetIamBindingCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -9524,6 +9856,13 @@ export declare namespace bigquery {
         title: string;
     }
     interface DatasetIamMemberCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -9976,6 +10315,9 @@ export declare namespace bigquery {
          * The separator for fields in a CSV file.
          */
         fieldDelimiter: string;
+        /**
+         * The value that is used to quote data sections in a CSV file. If your data does not contain quoted sections, set the property value to an empty string. If your data contains quoted newline characters, you must also set the allowQuotedNewlines property to true. The API-side default is ", specified in Terraform escaped as \". Due to limitations with Terraform default values, this value is required to be explicitly set.
+         */
         quote: string;
         /**
          * The number of rows at the top of a CSV file that BigQuery will skip when reading the data.
@@ -12993,6 +13335,13 @@ export declare namespace certificateauthority {
         cloudKmsKey?: string;
     }
     interface CaPoolIamBindingCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -13004,6 +13353,13 @@ export declare namespace certificateauthority {
         title: string;
     }
     interface CaPoolIamMemberCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -14163,6 +14519,13 @@ export declare namespace certificateauthority {
         revocationTime: string;
     }
     interface CertificateTemplateIamBindingCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -14174,6 +14537,13 @@ export declare namespace certificateauthority {
         title: string;
     }
     interface CertificateTemplateIamMemberCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -15029,6 +15399,9 @@ export declare namespace certificatemanager {
          * A human-readable description of the resource.
          */
         description: string;
+        /**
+         * All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
+         */
         effectiveLabels: {
             [key: string]: string;
         };
@@ -20082,6 +20455,173 @@ export declare namespace ces {
          */
         name: string;
     }
+    interface ToolsetMcpToolset {
+        /**
+         * Authentication information required to access tools and execute a tool
+         * against the MCP server. For API key auth, the API key can only be sent in
+         * the request header; sending it via query parameters is not supported.
+         * Structure is documented below.
+         */
+        apiAuthentication?: outputs.ces.ToolsetMcpToolsetApiAuthentication;
+        /**
+         * The address of the MCP server, for example, "https://example.com/mcp/". If
+         * the server is built with the MCP SDK, the url should be suffixed with
+         * "/mcp/". Only Streamable HTTP transport based servers are supported. See
+         * https://modelcontextprotocol.io/specification/2025-03-26/basic/transports#streamable-http
+         * for more details.
+         */
+        serverAddress: string;
+        /**
+         * Service Directory configuration for VPC-SC, used to resolve service names
+         * within a perimeter.
+         * Structure is documented below.
+         */
+        serviceDirectoryConfig?: outputs.ces.ToolsetMcpToolsetServiceDirectoryConfig;
+        /**
+         * The TLS configuration. Includes the custom server certificates that the
+         * client should trust.
+         * Structure is documented below.
+         */
+        tlsConfig?: outputs.ces.ToolsetMcpToolsetTlsConfig;
+    }
+    interface ToolsetMcpToolsetApiAuthentication {
+        /**
+         * Configurations for authentication with API key.
+         * Structure is documented below.
+         */
+        apiKeyConfig?: outputs.ces.ToolsetMcpToolsetApiAuthenticationApiKeyConfig;
+        /**
+         * Configurations for authentication with a bearer token.
+         * Structure is documented below.
+         */
+        bearerTokenConfig?: outputs.ces.ToolsetMcpToolsetApiAuthenticationBearerTokenConfig;
+        /**
+         * Configurations for authentication with OAuth.
+         * Structure is documented below.
+         */
+        oauthConfig?: outputs.ces.ToolsetMcpToolsetApiAuthenticationOauthConfig;
+        /**
+         * Configurations for authentication using a custom service account.
+         * Structure is documented below.
+         */
+        serviceAccountAuthConfig?: outputs.ces.ToolsetMcpToolsetApiAuthenticationServiceAccountAuthConfig;
+        /**
+         * Configurations for authentication with [ID
+         * token](https://cloud.google.com/docs/authentication/token-types#id) generated
+         * from service agent.
+         */
+        serviceAgentIdTokenAuthConfig?: outputs.ces.ToolsetMcpToolsetApiAuthenticationServiceAgentIdTokenAuthConfig;
+    }
+    interface ToolsetMcpToolsetApiAuthenticationApiKeyConfig {
+        /**
+         * The name of the SecretManager secret version resource storing the API key.
+         * Format: `projects/{project}/secrets/{secret}/versions/{version}`
+         * Note: You should grant `roles/secretmanager.secretAccessor` role to the CES
+         * service agent
+         * `service-@gcp-sa-ces.iam.gserviceaccount.com`.
+         */
+        apiKeySecretVersion: string;
+        /**
+         * The parameter name or the header name of the API key.
+         * E.g., If the API request is "https://example.com/act?X-Api-Key=", "X-Api-Key" would be the parameter name.
+         */
+        keyName: string;
+        /**
+         * Key location in the request. For API key auth on MCP toolsets,
+         * the API key can only be sent in the request header.
+         * Possible values:
+         * HEADER
+         */
+        requestLocation: string;
+    }
+    interface ToolsetMcpToolsetApiAuthenticationBearerTokenConfig {
+        /**
+         * (Optional)
+         */
+        token?: string;
+    }
+    interface ToolsetMcpToolsetApiAuthenticationOauthConfig {
+        /**
+         * The client ID from the OAuth provider.
+         */
+        clientId: string;
+        /**
+         * The name of the SecretManager secret version resource storing the
+         * client secret.
+         * Format: `projects/{project}/secrets/{secret}/versions/{version}`
+         * Note: You should grant `roles/secretmanager.secretAccessor` role to the CES
+         * service agent
+         * `service-@gcp-sa-ces.iam.gserviceaccount.com`.
+         */
+        clientSecretVersion: string;
+        /**
+         * OAuth grant types.
+         * Possible values:
+         * CLIENT_CREDENTIAL
+         */
+        oauthGrantType: string;
+        /**
+         * The OAuth scopes to grant.
+         */
+        scopes?: string[];
+        /**
+         * The token endpoint in the OAuth provider to exchange for an access token.
+         */
+        tokenEndpoint: string;
+    }
+    interface ToolsetMcpToolsetApiAuthenticationServiceAccountAuthConfig {
+        /**
+         * The email address of the service account used for authenticatation. CES
+         * uses this service account to exchange an access token and the access token
+         * is then sent in the `Authorization` header of the request.
+         * The service account must have the
+         * `roles/iam.serviceAccountTokenCreator` role granted to the
+         * CES service agent
+         * `service-@gcp-sa-ces.iam.gserviceaccount.com`.
+         */
+        serviceAccount: string;
+    }
+    interface ToolsetMcpToolsetApiAuthenticationServiceAgentIdTokenAuthConfig {
+    }
+    interface ToolsetMcpToolsetServiceDirectoryConfig {
+        /**
+         * The name of [Service
+         * Directory](https://cloud.google.com/service-directory) service.
+         * Format:
+         * `projects/{project}/locations/{location}/namespaces/{namespace}/services/{service}`.
+         * Location of the service directory must be the same as the location of the
+         * app.
+         */
+        service: string;
+    }
+    interface ToolsetMcpToolsetTlsConfig {
+        /**
+         * Specifies a list of allowed custom CA certificates for HTTPS
+         * verification.
+         * Structure is documented below.
+         */
+        caCerts: outputs.ces.ToolsetMcpToolsetTlsConfigCaCert[];
+    }
+    interface ToolsetMcpToolsetTlsConfigCaCert {
+        /**
+         * The allowed custom CA certificates (in DER format) for
+         * HTTPS verification. This overrides the default SSL trust store. If this
+         * is empty or unspecified, CES will use Google's default trust
+         * store to verify certificates. N.B. Make sure the HTTPS server
+         * certificates are signed with "subject alt name". For instance a
+         * certificate can be self-signed using the following command,
+         * openssl x509 -req -days 200 -in example.com.csr \
+         * -signkey example.com.key \
+         * -out example.com.crt \
+         * -extfile <(printf "\nsubjectAltName='DNS:www.example.com'")
+         */
+        cert: string;
+        /**
+         * The name of the allowed custom CA certificates. This
+         * can be used to disambiguate the custom CA certificates.
+         */
+        displayName: string;
+    }
     interface ToolsetOpenApiToolset {
         /**
          * Authentication information required for API calls.
@@ -20161,10 +20701,10 @@ export declare namespace ces {
          */
         keyName: string;
         /**
-         * Key location in the request.
+         * Key location in the request. For API key auth on MCP toolsets,
+         * the API key can only be sent in the request header.
          * Possible values:
          * HEADER
-         * QUERY_STRING
          */
         requestLocation: string;
     }
@@ -25193,6 +25733,35 @@ export declare namespace cloudidentity {
          */
         expireTime: string;
     }
+    interface PolicyPolicyQuery {
+        /**
+         * The group that the query applies to.
+         */
+        group?: string;
+        /**
+         * The OrgUnit the query applies to.
+         */
+        orgUnit: string;
+        /**
+         * The CEL query that defines which entities the Policy applies to.
+         */
+        query?: string;
+        /**
+         * (Output)
+         * Decimal sort order of this PolicyQuery.
+         */
+        sortOrder: number;
+    }
+    interface PolicySetting {
+        /**
+         * The type of the Setting.
+         */
+        type: string;
+        /**
+         * The value of the Setting as JSON string.
+         */
+        valueJson: string;
+    }
 }
 export declare namespace cloudquota {
     interface GetSQuotaInfoDimensionsInfo {
@@ -25371,6 +25940,10 @@ export declare namespace cloudrun {
         annotations?: {
             [key: string]: string;
         };
+        /**
+         * (Output)
+         * All of annotations (key/value pairs) present on the resource in GCP, including the annotations configured through Terraform, other clients and services.
+         */
         effectiveAnnotations: {
             [key: string]: string;
         };
@@ -25403,9 +25976,8 @@ export declare namespace cloudrun {
          */
         namespace: string;
         /**
-         * (Output)
          * The combination of labels configured directly on the resource
-         * and default labels configured on the provider.
+         *  and default labels configured on the provider.
          */
         pulumiLabels: {
             [key: string]: string;
@@ -25521,12 +26093,47 @@ export declare namespace cloudrun {
         type?: string;
     }
     interface GetServiceMetadata {
+        /**
+         * Annotations is a key value map stored with a resource that
+         * may be set by external tools to store and retrieve arbitrary metadata.
+         * More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
+         *
+         * **Note**: The Cloud Run API may add additional annotations that were not provided in your config.
+         * If terraform plan shows a diff where a server-side annotation is added, you can add it to your config
+         * or apply the lifecycle.ignore_changes rule to the metadata.0.annotations field.
+         *
+         * Annotations with 'run.googleapis.com/' and 'autoscaling.knative.dev' are restricted. Use the following annotation
+         * keys to configure features on a Service:
+         *
+         * - 'run.googleapis.com/binary-authorization-breakglass' sets the [Binary Authorization breakglass](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--breakglass).
+         * - 'run.googleapis.com/binary-authorization' sets the [Binary Authorization](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--binary-authorization).
+         * - 'run.googleapis.com/client-name' sets the client name calling the Cloud Run API.
+         * - 'run.googleapis.com/custom-audiences' sets the [custom audiences](https://cloud.google.com/sdk/gcloud/reference/alpha/run/deploy#--add-custom-audiences)
+         *   that can be used in the audience field of ID token for authenticated requests.
+         * - 'run.googleapis.com/description' sets a user defined description for the Service.
+         * - 'run.googleapis.com/ingress' sets the [ingress settings](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--ingress)
+         *   for the Service. For example, '"run.googleapis.com/ingress" = "all"'.
+         * - 'run.googleapis.com/launch-stage' sets the [launch stage](https://cloud.google.com/run/docs/troubleshooting#launch-stage-validation)
+         *   when a preview feature is used. For example, '"run.googleapis.com/launch-stage": "BETA"'
+         * - 'run.googleapis.com/minScale' sets the [minimum number of container instances](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--min) of the Service.
+         * - 'run.googleapis.com/scalingMode' sets the type of scaling mode for the service. The supported values for scaling mode are "manual" and "automatic". If not provided, it defaults to "automatic".
+         * - 'run.googleapis.com/manualInstanceCount' sets the total instance count for the service in manual scaling mode. This number of instances is divided among all revisions with specified traffic based on the percent of traffic they are receiving.
+         *
+         * **Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+         * Please refer to the field 'effective_annotations' for all of the annotations present on the resource.
+         */
         annotations: {
             [key: string]: string;
         };
+        /**
+         * All of annotations (key/value pairs) present on the resource in GCP, including the annotations configured through Terraform, other clients and services.
+         */
         effectiveAnnotations: {
             [key: string]: string;
         };
+        /**
+         * All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
+         */
         effectiveLabels: {
             [key: string]: string;
         };
@@ -25674,6 +26281,54 @@ export declare namespace cloudrun {
         specs: outputs.cloudrun.GetServiceTemplateSpec[];
     }
     interface GetServiceTemplateMetadata {
+        /**
+         * Annotations is a key value map stored with a resource that
+         * may be set by external tools to store and retrieve arbitrary metadata.
+         * More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
+         *
+         * **Note**: The Cloud Run API may add additional annotations that were not provided in your config.
+         * If terraform plan shows a diff where a server-side annotation is added, you can add it to your config
+         * or apply the lifecycle.ignore_changes rule to the metadata.0.annotations field.
+         *
+         * Annotations with 'run.googleapis.com/' and 'autoscaling.knative.dev' are restricted. Use the following annotation
+         * keys to configure features on a Revision template:
+         *
+         * - 'autoscaling.knative.dev/maxScale' sets the [maximum number of container
+         *   instances](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--max-instances) of the Revision to run.
+         * - 'autoscaling.knative.dev/minScale' sets the [minimum number of container
+         *   instances](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--min-instances) of the Revision to run.
+         * - 'run.googleapis.com/client-name' sets the client name calling the Cloud Run API.
+         * - 'run.googleapis.com/cloudsql-instances' sets the [Cloud SQL
+         *   instances](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--add-cloudsql-instances) the Revision connects to.
+         * - 'run.googleapis.com/cpu-throttling' sets whether to throttle the CPU when the container is not actively serving
+         *   requests. See https://cloud.google.com/sdk/gcloud/reference/run/deploy#--[no-]cpu-throttling.
+         * - 'run.googleapis.com/encryption-key-shutdown-hours' sets the number of hours to wait before an automatic shutdown
+         *   server after CMEK key revocation is detected.
+         * - 'run.googleapis.com/encryption-key' sets the [CMEK key](https://cloud.google.com/run/docs/securing/using-cmek)
+         *   reference to encrypt the container with.
+         * - 'run.googleapis.com/execution-environment' sets the [execution
+         *   environment](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--execution-environment)
+         *   where the application will run.
+         * - 'run.googleapis.com/post-key-revocation-action-type' sets the
+         *   [action type](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--post-key-revocation-action-type)
+         *   after CMEK key revocation.
+         * - 'run.googleapis.com/secrets' sets a list of key-value pairs to set as
+         *   [secrets](https://cloud.google.com/run/docs/configuring/secrets#yaml).
+         * - 'run.googleapis.com/sessionAffinity' sets whether to enable
+         *   [session affinity](https://cloud.google.com/sdk/gcloud/reference/beta/run/deploy#--[no-]session-affinity)
+         *   for connections to the Revision.
+         * - 'run.googleapis.com/startup-cpu-boost' sets whether to allocate extra CPU to containers on startup.
+         *   See https://cloud.google.com/sdk/gcloud/reference/run/deploy#--[no-]cpu-boost.
+         * - 'run.googleapis.com/network-interfaces' sets [Direct VPC egress](https://cloud.google.com/run/docs/configuring/vpc-direct-vpc#yaml)
+         *   for the Revision.
+         * - 'run.googleapis.com/vpc-access-connector' sets a [VPC connector](https://cloud.google.com/run/docs/configuring/connecting-vpc#terraform_1)
+         *   for the Revision.
+         * - 'run.googleapis.com/vpc-access-egress' sets the outbound traffic to send through the VPC connector for this resource.
+         *   See https://cloud.google.com/sdk/gcloud/reference/run/deploy#--vpc-egress.
+         * - 'run.googleapis.com/gpu-zonal-redundancy-disabled' sets
+         *   [GPU zonal redundancy](https://cloud.google.com/run/docs/configuring/services/gpu-zonal-redundancy) for the Revision.
+         * - 'run.googleapis.com/health-check-disabled' disabled health checking containers during deployment.
+         */
         annotations: {
             [key: string]: string;
         };
@@ -26343,6 +26998,10 @@ export declare namespace cloudrun {
         annotations?: {
             [key: string]: string;
         };
+        /**
+         * (Output)
+         * All of annotations (key/value pairs) present on the resource in GCP, including the annotations configured through Terraform, other clients and services.
+         */
         effectiveAnnotations: {
             [key: string]: string;
         };
@@ -26374,9 +27033,8 @@ export declare namespace cloudrun {
          */
         namespace: string;
         /**
-         * (Output)
          * The combination of labels configured directly on the resource
-         * and default labels configured on the provider.
+         *  and default labels configured on the provider.
          */
         pulumiLabels: {
             [key: string]: string;
@@ -27993,6 +28651,10 @@ export declare namespace cloudrunv2 {
          * If omitted, a port number will be chosen and passed to the container through the PORT environment variable for the container to listen on
          */
         ports: outputs.cloudrunv2.GetServiceTemplateContainerPort[];
+        /**
+         * Periodic probe of container readiness.
+         */
+        readinessProbes: outputs.cloudrunv2.GetServiceTemplateContainerReadinessProbe[];
         /**
          * Compute Resource requirements by this container. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
          */
@@ -28140,6 +28802,60 @@ export declare namespace cloudrunv2 {
          */
         name: string;
     }
+    interface GetServiceTemplateContainerReadinessProbe {
+        /**
+         * Minimum consecutive failures for the probe to be considered failed after
+         * having succeeded. Defaults to 3.
+         */
+        failureThreshold: number;
+        /**
+         * GRPC specifies an action involving a GRPC port.
+         */
+        grpcs: outputs.cloudrunv2.GetServiceTemplateContainerReadinessProbeGrpc[];
+        /**
+         * HttpGet specifies the http request to perform.
+         */
+        httpGets: outputs.cloudrunv2.GetServiceTemplateContainerReadinessProbeHttpGet[];
+        /**
+         * How often (in seconds) to perform the probe.
+         * Default to 10 seconds.
+         */
+        periodSeconds: number;
+        /**
+         * Minimum consecutive successes for the probe to be considered successful after having failed.
+         * Defaults to 2.
+         */
+        successThreshold: number;
+        /**
+         * Number of seconds after which the probe times out.
+         * Defaults to 1 second. Must be smaller than period_seconds.
+         */
+        timeoutSeconds: number;
+    }
+    interface GetServiceTemplateContainerReadinessProbeGrpc {
+        /**
+         * Port number to access on the container. Number must be in the range 1 to 65535.
+         * If not specified, defaults to the same value as container.ports[0].containerPort.
+         */
+        port: number;
+        /**
+         * The name of the service to place in the gRPC HealthCheckRequest
+         * (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+         * If this is not specified, the default behavior is defined by gRPC.
+         */
+        service: string;
+    }
+    interface GetServiceTemplateContainerReadinessProbeHttpGet {
+        /**
+         * Path to access on the HTTP server. If set, it should not be empty string.
+         */
+        path: string;
+        /**
+         * Port number to access on the container. Number must be in the range 1 to 65535.
+         * If not specified, defaults to the same value as container.ports[0].containerPort.
+         */
+        port: number;
+    }
     interface GetServiceTemplateContainerResource {
         /**
          * Determines whether CPU is only allocated during requests. True by default if the parent 'resources' field is not set. However, if
@@ -29899,6 +30615,11 @@ export declare namespace cloudrunv2 {
          * Structure is documented below.
          */
         ports: outputs.cloudrunv2.ServiceTemplateContainerPorts;
+        /**
+         * Periodic probe of container readiness.
+         * Structure is documented below.
+         */
+        readinessProbe?: outputs.cloudrunv2.ServiceTemplateContainerReadinessProbe;
         /**
          * Compute Resource requirements by this container. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
          * Structure is documented below.
@@ -30022,11 +30743,11 @@ export declare namespace cloudrunv2 {
          */
         httpHeaders?: outputs.cloudrunv2.ServiceTemplateContainerLivenessProbeHttpGetHttpHeader[];
         /**
-         * Path to access on the HTTP server. Defaults to '/'.
+         * Path to access on the HTTP server. If set, it should not be empty string.
          */
         path?: string;
         /**
-         * Port number to access on the container. Must be in the range 1 to 65535.
+         * Port number to access on the container. Number must be in the range 1 to 65535.
          * If not specified, defaults to the same value as container.ports[0].containerPort.
          */
         port: number;
@@ -30058,6 +30779,64 @@ export declare namespace cloudrunv2 {
          */
         name: string;
     }
+    interface ServiceTemplateContainerReadinessProbe {
+        /**
+         * Minimum consecutive failures for the probe to be considered failed after
+         * having succeeded. Defaults to 3.
+         */
+        failureThreshold: number;
+        /**
+         * GRPC specifies an action involving a GRPC port.
+         * Structure is documented below.
+         */
+        grpc?: outputs.cloudrunv2.ServiceTemplateContainerReadinessProbeGrpc;
+        /**
+         * HttpGet specifies the http request to perform.
+         * Structure is documented below.
+         */
+        httpGet?: outputs.cloudrunv2.ServiceTemplateContainerReadinessProbeHttpGet;
+        /**
+         * How often (in seconds) to perform the probe.
+         * Default to 10 seconds.
+         */
+        periodSeconds: number;
+        /**
+         * Minimum consecutive successes for the probe to be considered successful after having failed.
+         * Defaults to 2.
+         */
+        successThreshold: number;
+        /**
+         * Number of seconds after which the probe times out.
+         * Defaults to 1 second. Must be smaller than period_seconds.
+         */
+        timeoutSeconds: number;
+    }
+    interface ServiceTemplateContainerReadinessProbeGrpc {
+        /**
+         * Port number to access on the container. Number must be in the range 1 to 65535.
+         * If not specified, defaults to the same value as container.ports[0].containerPort.
+         */
+        port: number;
+        /**
+         * The name of the service to place in the gRPC HealthCheckRequest
+         * (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+         * If this is not specified, the default behavior is defined by gRPC.
+         *
+         * <a name="nestedTemplateContainersBuildInfo"></a>The `buildInfo` block contains:
+         */
+        service?: string;
+    }
+    interface ServiceTemplateContainerReadinessProbeHttpGet {
+        /**
+         * Path to access on the HTTP server. If set, it should not be empty string.
+         */
+        path: string;
+        /**
+         * Port number to access on the container. Number must be in the range 1 to 65535.
+         * If not specified, defaults to the same value as container.ports[0].containerPort.
+         */
+        port: number;
+    }
     interface ServiceTemplateContainerResources {
         /**
          * Determines whether CPU is only allocated during requests. True by default if the parent `resources` field is not set. However, if
@@ -30151,11 +30930,11 @@ export declare namespace cloudrunv2 {
          */
         httpHeaders?: outputs.cloudrunv2.ServiceTemplateContainerStartupProbeHttpGetHttpHeader[];
         /**
-         * Path to access on the HTTP server. Defaults to '/'.
+         * Path to access on the HTTP server. If set, it should not be empty string.
          */
         path?: string;
         /**
-         * Port number to access on the container. Must be in the range 1 to 65535.
+         * Port number to access on the container. Number must be in the range 1 to 65535.
          * If not specified, defaults to the same value as container.ports[0].containerPort.
          */
         port: number;
@@ -34290,6 +35069,13 @@ export declare namespace compute {
         enabled?: boolean;
     }
     interface BackendServiceIamBindingCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -34301,6 +35087,13 @@ export declare namespace compute {
         title: string;
     }
     interface BackendServiceIamMemberCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -34829,6 +35622,16 @@ export declare namespace compute {
          */
         ipv6Address?: string;
     }
+    interface ExternalVpnGatewayParams {
+        /**
+         * Resource manager tags to be bound to the ExternalVpnGateway. Tag keys and values have the
+         * same definition as resource manager tags. Keys must be in the format tagKeys/{tag_key_id},
+         * and values are in the format tagValues/456.
+         */
+        resourceManagerTags?: {
+            [key: string]: string;
+        };
+    }
     interface FirewallAllow {
         /**
          * An optional list of ports to which this rule applies. This field
@@ -36870,6 +37673,9 @@ export declare namespace compute {
          * you create the resource.
          */
         description: string;
+        /**
+         * All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
+         */
         effectiveLabels: {
             [key: string]: string;
         };
@@ -37108,6 +37914,9 @@ export declare namespace compute {
         pulumiLabels: {
             [key: string]: string;
         };
+        /**
+         * This is used in PSC consumer ForwardingRule to make terraform recreate the ForwardingRule when the status is closed
+         */
         recreateClosedPsc: boolean;
         /**
          * The region you want to get the forwarding rules from.
@@ -37228,6 +38037,16 @@ export declare namespace compute {
          */
         serviceDirectoryRegion: string;
     }
+    interface GetHcVpnGatewayParam {
+        /**
+         * Resource manager tags to be bound to the HaVpnGateway. Tag keys and values have the
+         * same definition as resource manager tags. Keys must be in the format tagKeys/{tag_key_id},
+         * and values are in the format tagValues/456.
+         */
+        resourceManagerTags: {
+            [key: string]: string;
+        };
+    }
     interface GetHcVpnGatewayVpnInterface {
         /**
          * The numeric ID of this VPN gateway interface.
@@ -38187,6 +39006,10 @@ export declare namespace compute {
          * The type of vNIC to be used on this interface. Possible values:GVNIC, VIRTIO_NET, IDPF, MRDMA, and IRDMA
          */
         nicType: string;
+        /**
+         * Name of the parent network interface of a dynamic network interface.
+         */
+        parentNicName: string;
         /**
          * The networking queue count that's specified by users for the network interface. Both Rx and Tx queues will be set to this number. It will be empty if not specified.
          */
@@ -38207,6 +39030,10 @@ export declare namespace compute {
          * The project in which the subnetwork belongs.
          */
         subnetworkProject: string;
+        /**
+         * VLAN tag of a dynamic network interface, must be an integer in the range from 2 to 255 inclusively.
+         */
+        vlan: number;
     }
     interface GetInstanceNetworkInterfaceAccessConfig {
         /**
@@ -38759,6 +39586,10 @@ export declare namespace compute {
          * The type of vNIC to be used on this interface. Possible values:GVNIC, VIRTIO_NET, MRDMA, and IRDMA
          */
         nicType: string;
+        /**
+         * Name of the parent network interface of a dynamic network interface.
+         */
+        parentNicName: string;
         /**
          * The networking queue count that's specified by users for the network interface. Both Rx and Tx queues will be set to this number. It will be empty if not specified.
          */
@@ -38778,6 +39609,10 @@ export declare namespace compute {
          * If it is not provided, the provider project is used.
          */
         subnetworkProject: string;
+        /**
+         * VLAN tag of a dynamic network interface, must be an integer in the range from 2 to 255 inclusively.
+         */
+        vlan: number;
     }
     interface GetInstanceTemplateNetworkInterfaceAccessConfig {
         /**
@@ -40657,6 +41492,14 @@ export declare namespace compute {
         type: string;
     }
     interface GetRegionInstanceTemplateNetworkInterface {
+        /**
+         * Access configurations, i.e. IPs via which this
+         * instance can be accessed via the Internet. Omit to ensure that the instance
+         * is not accessible from the Internet (this means that ssh provisioners will
+         * not work unless you are running Terraform can send traffic to the instance's
+         * network (e.g. via tunnel or because it is running on another cloud instance
+         * on that network). This block can be repeated multiple times. Structure documented below.
+         */
         accessConfigs: outputs.compute.GetRegionInstanceTemplateNetworkInterfaceAccessConfig[];
         /**
          * An
@@ -40694,6 +41537,10 @@ export declare namespace compute {
          * `subnetwork` for custom subnetted networks.
          */
         network: string;
+        /**
+         * The URL of the network attachment that this interface should connect to in the following format: projects/{projectNumber}/regions/{region_name}/networkAttachments/{network_attachment_name}.
+         */
+        networkAttachment: string;
         /**
          * The private IP address to assign to the instance. If
          * empty, the address will be automatically assigned.
@@ -40703,6 +41550,10 @@ export declare namespace compute {
          * The type of vNIC to be used on this interface. Possible values:GVNIC, VIRTIO_NET, MRDMA, and IRDMA
          */
         nicType: string;
+        /**
+         * Name of the parent network interface of a dynamic network interface.
+         */
+        parentNicName: string;
         /**
          * The networking queue count that's specified by users for the network interface. Both Rx and Tx queues will be set to this number. It will be empty if not specified.
          */
@@ -40722,6 +41573,10 @@ export declare namespace compute {
          * If it is not provided, the provider project is used.
          */
         subnetworkProject: string;
+        /**
+         * VLAN tag of a dynamic network interface, must be an integer in the range from 2 to 255 inclusively.
+         */
+        vlan: number;
     }
     interface GetRegionInstanceTemplateNetworkInterfaceAccessConfig {
         /**
@@ -43274,6 +44129,16 @@ export declare namespace compute {
          */
         serviceDirectoryRegion?: string;
     }
+    interface HaVpnGatewayParams {
+        /**
+         * Resource manager tags to be bound to the HaVpnGateway. Tag keys and values have the
+         * same definition as resource manager tags. Keys must be in the format tagKeys/{tag_key_id},
+         * and values are in the format tagValues/456.
+         */
+        resourceManagerTags?: {
+            [key: string]: string;
+        };
+    }
     interface HaVpnGatewayVpnInterface {
         /**
          * The numeric ID of this VPN gateway interface.
@@ -44051,7 +44916,7 @@ export declare namespace compute {
          */
         provisionedThroughput: number;
         /**
-         * A map of resource manager tags. Resource manager tag keys and values have the same definition as resource manager tags. Keys must be in the format tagKeys/{tag_key_id}, and values are in the format tagValues/456. The field is ignored (both PUT & PATCH) when empty.
+         * A tag is a key-value pair that can be attached to a Google Cloud resource. You can use tags to conditionally allow or deny policies based on whether a resource has a specific tag. This value is not returned by the API. In Terraform, this value cannot be updated and changing it will recreate the resource.
          */
         resourceManagerTags?: {
             [key: string]: string;
@@ -44472,6 +45337,10 @@ export declare namespace compute {
          * The type of vNIC to be used on this interface. Possible values:GVNIC, VIRTIO_NET, IDPF, MRDMA, and IRDMA
          */
         nicType: string;
+        /**
+         * Name of the parent network interface of a dynamic network interface.
+         */
+        parentNicName: string;
         /**
          * The networking queue count that's specified by users for the network interface. Both Rx and Tx queues will be set to this number. It will be empty if not specified.
          */
@@ -44492,6 +45361,10 @@ export declare namespace compute {
          * The project in which the subnetwork belongs.
          */
         subnetworkProject: string;
+        /**
+         * VLAN tag of a dynamic network interface, must be an integer in the range from 2 to 255 inclusively.
+         */
+        vlan: number;
     }
     interface InstanceFromMachineImageNetworkInterfaceAccessConfig {
         /**
@@ -45075,6 +45948,10 @@ export declare namespace compute {
          * The type of vNIC to be used on this interface. Possible values:GVNIC, VIRTIO_NET, IDPF, MRDMA, and IRDMA
          */
         nicType: string;
+        /**
+         * Name of the parent network interface of a dynamic network interface.
+         */
+        parentNicName: string;
         /**
          * The networking queue count that's specified by users for the network interface. Both Rx and Tx queues will be set to this number. It will be empty if not specified.
          */
@@ -45095,6 +45972,10 @@ export declare namespace compute {
          * The project in which the subnetwork belongs.
          */
         subnetworkProject: string;
+        /**
+         * VLAN tag of a dynamic network interface, must be an integer in the range from 2 to 255 inclusively.
+         */
+        vlan: number;
     }
     interface InstanceFromTemplateNetworkInterfaceAccessConfig {
         /**
@@ -45671,7 +46552,12 @@ export declare namespace compute {
     }
     interface InstanceNetworkInterface {
         /**
-         * Access configurations, i.e. IPs via which this instance can be accessed via the Internet.
+         * Access configurations, i.e. IPs via which this
+         * instance can be accessed via the Internet. Omit to ensure that the instance
+         * is not accessible from the Internet. If omitted, ssh provisioners will not
+         * work unless Terraform can send traffic to the instance's network (e.g. via
+         * tunnel or because it is running on another cloud instance on that network).
+         * This block can be specified once per `networkInterface`. Structure documented below.
          */
         accessConfigs?: outputs.compute.InstanceNetworkInterfaceAccessConfig[];
         /**
@@ -45731,6 +46617,10 @@ export declare namespace compute {
          * The type of vNIC to be used on this interface. Possible values: GVNIC, VIRTIO_NET, IDPF, MRDMA, IRDMA.
          */
         nicType?: string;
+        /**
+         * Name of the parent network interface of a dynamic network interface.
+         */
+        parentNicName: string;
         /**
          * The networking queue count that's specified by users for the network interface. Both Rx and Tx queues will be set to this number. It will be empty if not specified.
          */
@@ -45760,6 +46650,10 @@ export declare namespace compute {
          * field is not provided, the provider project is used.
          */
         subnetworkProject: string;
+        /**
+         * VLAN tag of a dynamic network interface, must be an integer in the range from 2 to 255 inclusively.
+         */
+        vlan?: number;
     }
     interface InstanceNetworkInterfaceAccessConfig {
         /**
@@ -45833,7 +46727,7 @@ export declare namespace compute {
     }
     interface InstanceParams {
         /**
-         * A map of resource manager tags. Resource manager tag keys and values have the same definition as resource manager tags. Keys must be in the format tagKeys/{tag_key_id}, and values are in the format tagValues/456. The field is ignored (both PUT & PATCH) when empty.
+         * A tag is a key-value pair that can be attached to a Google Cloud resource. You can use tags to conditionally allow or deny policies based on whether a resource has a specific tag. This value is not returned by the API. In Terraform, this value cannot be updated and changing it will recreate the resource.
          */
         resourceManagerTags?: {
             [key: string]: string;
@@ -46318,6 +47212,13 @@ export declare namespace compute {
         type: string;
     }
     interface InstanceTemplateIamBindingCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -46329,6 +47230,13 @@ export declare namespace compute {
         title: string;
     }
     interface InstanceTemplateIamMemberCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -46389,7 +47297,7 @@ export declare namespace compute {
          */
         network: string;
         /**
-         * ) The URL of the network attachment that this interface should connect to in the following format: projects/{projectNumber}/regions/{region_name}/networkAttachments/{network_attachment_name}.
+         * The URL of the network attachment that this interface should connect to in the following format: projects/{projectNumber}/regions/{region_name}/networkAttachments/{network_attachment_name}.
          */
         networkAttachment: string;
         /**
@@ -46401,6 +47309,10 @@ export declare namespace compute {
          * The type of vNIC to be used on this interface. Possible values: GVNIC, VIRTIO_NET, MRDMA, IRDMA.
          */
         nicType?: string;
+        /**
+         * Name of the parent network interface of a dynamic network interface.
+         */
+        parentNicName: string;
         /**
          * The networking queue count that's specified by users for the network interface. Both Rx and Tx queues will be set to this number. It will be empty if not specified.
          */
@@ -46420,6 +47332,10 @@ export declare namespace compute {
          * If it is not provided, the provider project is used.
          */
         subnetworkProject: string;
+        /**
+         * VLAN tag of a dynamic network interface, must be an integer in the range from 2 to 255 inclusively.
+         */
+        vlan?: number;
     }
     interface InstanceTemplateNetworkInterfaceAccessConfig {
         /**
@@ -46693,6 +47609,13 @@ export declare namespace compute {
         enableVtpm?: boolean;
     }
     interface InstantSnapshotIamBindingCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -46704,6 +47627,13 @@ export declare namespace compute {
         title: string;
     }
     interface InstantSnapshotIamMemberCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -46957,7 +47887,6 @@ export declare namespace compute {
     interface InterconnectAttachmentL2Forwarding {
         /**
          * A map of VLAN tags to appliances and optional inner mapping rules.
-         * Structure is documented below.
          */
         applianceMappings?: outputs.compute.InterconnectAttachmentL2ForwardingApplianceMapping[];
         /**
@@ -46966,7 +47895,6 @@ export declare namespace compute {
         defaultApplianceIpAddress?: string;
         /**
          * GeneveHeader related configurations.
-         * Structure is documented below.
          */
         geneveHeader?: outputs.compute.InterconnectAttachmentL2ForwardingGeneveHeader;
         /**
@@ -47012,6 +47940,18 @@ export declare namespace compute {
          */
         vni?: number;
     }
+    interface InterconnectAttachmentParams {
+        /**
+         * Resource manager tags to be bound to the interconnect attachment. Tag keys and values have the
+         * same definition as resource manager tags. Keys must be in the format tagKeys/{tag_key_id},
+         * and values are in the format tagValues/456.
+         *
+         * <a name="nestedL2Forwarding"></a>The `l2Forwarding` block supports:
+         */
+        resourceManagerTags?: {
+            [key: string]: string;
+        };
+    }
     interface InterconnectAttachmentPrivateInterconnectInfo {
         /**
          * (Output)
@@ -49171,6 +50111,13 @@ export declare namespace compute {
         instance?: string;
     }
     interface RegionBackendServiceIamBindingCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -49182,6 +50129,13 @@ export declare namespace compute {
         title: string;
     }
     interface RegionBackendServiceIamMemberCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -49245,14 +50199,12 @@ export declare namespace compute {
     }
     interface RegionBackendServiceNetworkPassThroughLbTrafficPolicyZonalAffinity {
         /**
-         * (Optional, Beta)
          * This field indicates whether zonal affinity is enabled or not.
          * Default value is `ZONAL_AFFINITY_DISABLED`.
          * Possible values are: `ZONAL_AFFINITY_DISABLED`, `ZONAL_AFFINITY_SPILL_CROSS_ZONE`, `ZONAL_AFFINITY_STAY_WITHIN_ZONE`.
          */
         spillover?: string;
         /**
-         * (Optional, Beta)
          * The value of the field must be in [0, 1]. When the ratio of the count of healthy backend endpoints in a zone
          * to the count of backend endpoints in that same zone is equal to or above this threshold, the load balancer
          * distributes new connections to all healthy endpoints in the local zone only. When the ratio of the count
@@ -50551,6 +51503,14 @@ export declare namespace compute {
         type: string;
     }
     interface RegionInstanceTemplateNetworkInterface {
+        /**
+         * Access configurations, i.e. IPs via which this
+         * instance can be accessed via the Internet. Omit to ensure that the instance
+         * is not accessible from the Internet (this means that ssh provisioners will
+         * not work unless you are running Terraform can send traffic to the instance's
+         * network (e.g. via tunnel or because it is running on another cloud instance
+         * on that network). This block can be specified once per `networkInterface`. Structure documented below.
+         */
         accessConfigs?: outputs.compute.RegionInstanceTemplateNetworkInterfaceAccessConfig[];
         /**
          * An
@@ -50581,7 +51541,8 @@ export declare namespace compute {
          */
         ipv6Address: string;
         /**
-         * The name of the network_interface.
+         * The name of the instance template. If you leave
+         * this blank, Terraform will auto-generate a unique name.
          */
         name: string;
         /**
@@ -50590,6 +51551,10 @@ export declare namespace compute {
          * `subnetwork` for custom subnetted networks.
          */
         network: string;
+        /**
+         * The URL of the network attachment that this interface should connect to in the following format: projects/{projectNumber}/regions/{region_name}/networkAttachments/{network_attachment_name}.
+         */
+        networkAttachment: string;
         /**
          * The private IP address to assign to the instance. If
          * empty, the address will be automatically assigned.
@@ -50599,6 +51564,10 @@ export declare namespace compute {
          * The type of vNIC to be used on this interface. Possible values: GVNIC, VIRTIO_NET, MRDMA, IRDMA.
          */
         nicType?: string;
+        /**
+         * Name of the parent network interface of a dynamic network interface.
+         */
+        parentNicName: string;
         /**
          * The networking queue count that's specified by users for the network interface. Both Rx and Tx queues will be set to this number. It will be empty if not specified.
          */
@@ -50618,6 +51587,10 @@ export declare namespace compute {
          * If it is not provided, the provider project is used.
          */
         subnetworkProject: string;
+        /**
+         * VLAN tag of a dynamic network interface, must be an integer in the range from 2 to 255 inclusively.
+         */
+        vlan?: number;
     }
     interface RegionInstanceTemplateNetworkInterfaceAccessConfig {
         /**
@@ -50661,7 +51634,8 @@ export declare namespace compute {
          */
         externalIpv6PrefixLength: string;
         /**
-         * The name of this access configuration.
+         * The name of the instance template. If you leave
+         * this blank, Terraform will auto-generate a unique name.
          */
         name: string;
         /**
@@ -55070,6 +56044,117 @@ export declare namespace compute {
          */
         type: string;
     }
+    interface RolloutPlanWave {
+        /**
+         * The display name of this wave of the rollout plan.
+         */
+        displayName?: string;
+        /**
+         * (Output)
+         * The wave number.
+         */
+        number: number;
+        /**
+         * Options to control the pace of orchestration of a wave.
+         * Structure is documented below.
+         */
+        orchestrationOptions?: outputs.compute.RolloutPlanWaveOrchestrationOptions;
+        /**
+         * The selectors for this wave. There is a logical AND between each selector
+         * defined in a wave, so a resource must satisfy the criteria of *all* the
+         * specified selectors to be in scope for the wave.
+         * Structure is documented below.
+         */
+        selectors: outputs.compute.RolloutPlanWaveSelector[];
+        /**
+         * The validation to be performed before progressing to the next wave.
+         * Structure is documented below.
+         */
+        validation: outputs.compute.RolloutPlanWaveValidation;
+    }
+    interface RolloutPlanWaveOrchestrationOptions {
+        /**
+         * Delays, if any, to be added between batches of projects.
+         * Structure is documented below.
+         */
+        delays?: outputs.compute.RolloutPlanWaveOrchestrationOptionsDelay[];
+        /**
+         * Maximum number of locations to be orchestrated in parallel.
+         */
+        maxConcurrentLocations?: number;
+        /**
+         * Maximum number of resources to be orchestrated per location in parallel.
+         */
+        maxConcurrentResourcesPerLocation?: number;
+    }
+    interface RolloutPlanWaveOrchestrationOptionsDelay {
+        /**
+         * Controls whether the delay should only be added between batches of projects corresponding to different locations, or also between batches of projects corresponding to the same location.
+         * Possible values are: `DELIMITER_UNSPECIFIED`, `DELIMITER_LOCATION`, `DELIMITER_BATCH`.
+         */
+        delimiter?: string;
+        /**
+         * The duration of the delay, if any, to be added between batches of projects.
+         */
+        duration?: string;
+        /**
+         * Controls whether the specified duration is to be added at the end of each batch, or if the total processing time for each batch will be padded if needed to meet the specified duration.
+         * Possible values are: `TYPE_UNSPECIFIED`, `TYPE_OFFSET`, `TYPE_MINIMUM`.
+         */
+        type?: string;
+    }
+    interface RolloutPlanWaveSelector {
+        /**
+         * Roll out to resources by location.
+         * Structure is documented below.
+         */
+        locationSelector?: outputs.compute.RolloutPlanWaveSelectorLocationSelector;
+        /**
+         * Roll out to resources by Cloud Resource Manager resource hierarchy nodes such as projects, folders, orgs.
+         * Structure is documented below.
+         */
+        resourceHierarchySelector?: outputs.compute.RolloutPlanWaveSelectorResourceHierarchySelector;
+    }
+    interface RolloutPlanWaveSelectorLocationSelector {
+        /**
+         * Example: "us-central1-a"
+         */
+        includedLocations?: string[];
+    }
+    interface RolloutPlanWaveSelectorResourceHierarchySelector {
+        /**
+         * Format: "folders/{folder_id}"
+         */
+        includedFolders?: string[];
+        /**
+         * Format: "organizations/{organization_id}"
+         */
+        includedOrganizations?: string[];
+        /**
+         * Format: "projects/{project_id}"
+         */
+        includedProjects?: string[];
+    }
+    interface RolloutPlanWaveValidation {
+        /**
+         * Metadata required if type = "time".
+         * Structure is documented below.
+         */
+        timeBasedValidationMetadata?: outputs.compute.RolloutPlanWaveValidationTimeBasedValidationMetadata;
+        /**
+         * The type of the validation. Possible values:
+         * "manual": The system waits for an end-user approval API before progressing to the next wave.
+         * "time": The system waits for a user specified duration before progressing to the next wave.
+         */
+        type: string;
+    }
+    interface RolloutPlanWaveValidationTimeBasedValidationMetadata {
+        /**
+         * The duration that the system waits in between waves. This wait starts
+         * after all changes in the wave are rolled out.
+         */
+        waitDuration?: string;
+    }
     interface RouteAsPath {
         /**
          * (Output)
@@ -56528,6 +57613,13 @@ export declare namespace compute {
         rsaEncryptedKey?: string;
     }
     interface StoragePoolIamBindingCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -56539,6 +57631,13 @@ export declare namespace compute {
         title: string;
     }
     interface StoragePoolIamMemberCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -59043,6 +60142,16 @@ export declare namespace compute {
          */
         value: string;
     }
+    interface VPNGatewayParams {
+        /**
+         * Resource manager tags to be bound to the Vpn Gateway. Tag keys and values have the
+         * same definition as resource manager tags. Keys must be in the format tagKeys/{tag_key_id},
+         * and values are in the format tagValues/456.
+         */
+        resourceManagerTags?: {
+            [key: string]: string;
+        };
+    }
     interface VPNTunnelCipherSuite {
         /**
          * Cipher configuration for phase 1 of the IKE protocol.
@@ -59090,6 +60199,16 @@ export declare namespace compute {
          */
         pfs?: string[];
     }
+    interface VPNTunnelParams {
+        /**
+         * Resource manager tags to be bound to the Vpn Tunnel. Tag keys and values have the
+         * same definition as resource manager tags. Keys must be in the format tagKeys/{tag_key_id},
+         * and values are in the format tagValues/456.
+         */
+        resourceManagerTags?: {
+            [key: string]: string;
+        };
+    }
     interface WireGroupEndpoint {
         /**
          * The identifier for this object. Format specified above.
@@ -60233,6 +61352,10 @@ export declare namespace container {
          * for more information.
          */
         rayOperatorConfigs: outputs.container.ClusterAddonsConfigRayOperatorConfig[];
+        /**
+         * The status of the Slice Controller addon. It is disabled by default; set enabled = true to enable.
+         */
+        sliceControllerConfig: outputs.container.ClusterAddonsConfigSliceControllerConfig;
         /**
          * .
          * The status of the Stateful HA addon, which provides automatic configurable failover for stateful applications.
@@ -60344,6 +61467,9 @@ export declare namespace container {
     interface ClusterAddonsConfigRayOperatorConfigRayClusterMonitoringConfig {
         enabled: boolean;
     }
+    interface ClusterAddonsConfigSliceControllerConfig {
+        enabled: boolean;
+    }
     interface ClusterAddonsConfigStatefulHaConfig {
         enabled: boolean;
     }
@@ -60783,6 +61909,13 @@ export declare namespace container {
          * List of secondary ranges names within this subnetwork that can be used for pod IPs.
          */
         podIpv4RangeNames?: string[];
+        /**
+         * Status of the subnetwork. Additional subnet with DRAINING status will not be selected during new node pool creation
+         * Accepted values are:
+         * * `ACTIVE`: ACTIVE status indicates that the subnet is available for new node pool creation.
+         * * `DRAINING`: DRAINING status indicates that the subnet is not used for new node pool creation.
+         */
+        status?: string;
         /**
          * Name of the subnetwork. This can be the full path of the subnetwork or just the name.
          */
@@ -62027,6 +63160,9 @@ export declare namespace container {
          * Specify node upgrade settings to change how many nodes GKE attempts to upgrade at once. The number of nodes upgraded simultaneously is the sum of maxSurge and max_unavailable. The maximum number of nodes upgraded simultaneously is limited to 20.
          */
         upgradeSettings: outputs.container.ClusterNodePoolUpgradeSettings;
+        /**
+         * The Kubernetes version for the nodes in this pool. Note that if this field and autoUpgrade are both specified, they will fight each other for what the node version should be, so setting both is highly discouraged. While a fuzzy version can be specified, it's recommended that you specify explicit versions as Terraform will see spurious diffs when fuzzy versions are used. See the gcp.container.getEngineVersions data source's versionPrefix field to approximate fuzzy versions in a Terraform-compatible way.
+         */
         version: string;
     }
     interface ClusterNodePoolAutoConfig {
@@ -63688,6 +64824,10 @@ export declare namespace container {
          * The status of the Ray Operator addon, which enabled management of Ray AI/ML jobs on GKE. Defaults to disabled; set enabled = true to enable.
          */
         rayOperatorConfigs: outputs.container.GetClusterAddonsConfigRayOperatorConfig[];
+        /**
+         * The status of the Slice Controller addon. It is disabled by default; set enabled = true to enable.
+         */
+        sliceControllerConfigs: outputs.container.GetClusterAddonsConfigSliceControllerConfig[];
         /**
          * The status of the Stateful HA addon, which provides automatic configurable failover for stateful applications. Defaults to disabled; set enabled = true to enable.
          */
@@ -63774,6 +64914,9 @@ export declare namespace container {
     interface GetClusterAddonsConfigRayOperatorConfigRayClusterMonitoringConfig {
         enabled: boolean;
     }
+    interface GetClusterAddonsConfigSliceControllerConfig {
+        enabled: boolean;
+    }
     interface GetClusterAddonsConfigStatefulHaConfig {
         enabled: boolean;
     }
@@ -64163,6 +65306,10 @@ export declare namespace container {
          * List of secondary ranges names within this subnetwork that can be used for pod IPs.
          */
         podIpv4RangeNames: string[];
+        /**
+         * Status of the subnetwork, If in draining status, subnet will not be selected for new node pools.
+         */
+        status: string;
         /**
          * Name of the subnetwork. This can be the full path of the subnetwork or just the name.
          */
@@ -65186,6 +66333,9 @@ export declare namespace container {
          * Specify node upgrade settings to change how many nodes GKE attempts to upgrade at once. The number of nodes upgraded simultaneously is the sum of maxSurge and max_unavailable. The maximum number of nodes upgraded simultaneously is limited to 20.
          */
         upgradeSettings: outputs.container.GetClusterNodePoolUpgradeSetting[];
+        /**
+         * The Kubernetes version for the nodes in this pool. Note that if this field and autoUpgrade are both specified, they will fight each other for what the node version should be, so setting both is highly discouraged. While a fuzzy version can be specified, it's recommended that you specify explicit versions as Terraform will see spurious diffs when fuzzy versions are used. See the gcp.container.getEngineVersions data source's versionPrefix field to approximate fuzzy versions in a Terraform-compatible way.
+         */
         version: string;
     }
     interface GetClusterNodePoolAutoConfig {
@@ -76734,6 +77884,10 @@ export declare namespace dataproc {
          * for more information.
          */
         imageUri: string;
+        /**
+         * Instance flexibility Policy allowing a mixture of VM shapes.
+         */
+        instanceFlexibilityPolicy: outputs.dataproc.ClusterClusterConfigMasterConfigInstanceFlexibilityPolicy;
         /**
          * List of master instance names which
          * have been assigned to the cluster.
@@ -76801,6 +77955,36 @@ export declare namespace dataproc {
          */
         numLocalSsds: number;
     }
+    interface ClusterClusterConfigMasterConfigInstanceFlexibilityPolicy {
+        /**
+         * List of instance selection options that the group will use when creating new VMs.
+         */
+        instanceSelectionLists: outputs.dataproc.ClusterClusterConfigMasterConfigInstanceFlexibilityPolicyInstanceSelectionList[];
+        /**
+         * A list of instance selection results in the group.
+         */
+        instanceSelectionResults: outputs.dataproc.ClusterClusterConfigMasterConfigInstanceFlexibilityPolicyInstanceSelectionResult[];
+    }
+    interface ClusterClusterConfigMasterConfigInstanceFlexibilityPolicyInstanceSelectionList {
+        /**
+         * Full machine-type names, e.g. `"n1-standard-16"`.
+         */
+        machineTypes: string[];
+        /**
+         * Preference of this instance selection. A lower number means higher preference. Dataproc will first try to create a VM based on the machine-type with priority rank and fallback to next rank based on availability. Machine types and instance selections with the same priority have the same preference.
+         */
+        rank: number;
+    }
+    interface ClusterClusterConfigMasterConfigInstanceFlexibilityPolicyInstanceSelectionResult {
+        /**
+         * Full machine-type names, e.g. "n1-standard-16".
+         */
+        machineType: string;
+        /**
+         * Number of VM provisioned with the machine_type.
+         */
+        vmCount: number;
+    }
     interface ClusterClusterConfigMetastoreConfig {
         /**
          * Resource name of an existing Dataproc Metastore service.
@@ -77054,6 +78238,10 @@ export declare namespace dataproc {
          * for more information.
          */
         imageUri: string;
+        /**
+         * Instance flexibility Policy allowing a mixture of VM shapes.
+         */
+        instanceFlexibilityPolicy: outputs.dataproc.ClusterClusterConfigWorkerConfigInstanceFlexibilityPolicy;
         /**
          * List of worker instance names which have been assigned
          * to the cluster.
@@ -77126,6 +78314,36 @@ export declare namespace dataproc {
          */
         numLocalSsds: number;
     }
+    interface ClusterClusterConfigWorkerConfigInstanceFlexibilityPolicy {
+        /**
+         * List of instance selection options that the group will use when creating new VMs.
+         */
+        instanceSelectionLists: outputs.dataproc.ClusterClusterConfigWorkerConfigInstanceFlexibilityPolicyInstanceSelectionList[];
+        /**
+         * A list of instance selection results in the group.
+         */
+        instanceSelectionResults: outputs.dataproc.ClusterClusterConfigWorkerConfigInstanceFlexibilityPolicyInstanceSelectionResult[];
+    }
+    interface ClusterClusterConfigWorkerConfigInstanceFlexibilityPolicyInstanceSelectionList {
+        /**
+         * Full machine-type names, e.g. `"n1-standard-16"`.
+         */
+        machineTypes: string[];
+        /**
+         * Preference of this instance selection. A lower number means higher preference. Dataproc will first try to create a VM based on the machine-type with priority rank and fallback to next rank based on availability. Machine types and instance selections with the same priority have the same preference.
+         */
+        rank: number;
+    }
+    interface ClusterClusterConfigWorkerConfigInstanceFlexibilityPolicyInstanceSelectionResult {
+        /**
+         * Full machine-type names, e.g. "n1-standard-16".
+         */
+        machineType: string;
+        /**
+         * Number of VM provisioned with the machine_type.
+         */
+        vmCount: number;
+    }
     interface ClusterIAMBindingCondition {
         description?: string;
         expression: string;
@@ -78331,7 +79549,19 @@ export declare namespace dataproc {
     }
     interface WorkflowTemplateEncryptionConfig {
         /**
-         * Optional. The Cloud KMS key name to use for encryption.
+         * The Cloud KMS key name to use for encrypting workflow template [job arguments](https://docs.docs.cloud.google.com/dataproc/docs/concepts/workflows/use-workflows).
+         *
+         * When this this key is provided, the following workflow template job arguments, if present, are [CMEK encrypted](https://docs.cloud.google.com/dataproc/docs/concepts/configuring-clusters/customer-managed-encryption#use_cmek_with_workflow_template_data):
+         *
+         * - [FlinkJob args](https://docs.cloud.google.com/dataproc/docs/reference/rest/v1/FlinkJob)
+         * - [HadoopJob args](https://docs.cloud.google.com/dataproc/docs/reference/rest/v1/HadoopJob)
+         * - [SparkJob args](https://docs.cloud.google.com/dataproc/docs/reference/rest/v1/SparkJob)
+         * - [SparkRJob args](https://docs.cloud.google.com/dataproc/docs/reference/rest/v1/SparkRJob)
+         * - [PySparkJob args](https://docs.cloud.google.com/dataproc/docs/reference/rest/v1/PySparkJob)
+         * - [SparkSqlJob](https://docs.cloud.google.com/dataproc/docs/reference/rest/v1/SparkSqlJob) scriptVariables and queryList.queries
+         * - [HiveJob](https://docs.cloud.google.com/dataproc/docs/reference/rest/v1/HiveJob) scriptVariables and queryList.queries
+         * - [PigJob](https://docs.cloud.google.com/dataproc/docs/reference/rest/v1/PigJob) scriptVariables  and queryList.queries
+         * - [PrestoJob](https://docs.cloud.google.com/dataproc/docs/reference/rest/v1/PrestoJob) scriptVariables and queryList.queries
          */
         kmsKey?: string;
     }
@@ -78867,7 +80097,7 @@ export declare namespace dataproc {
          */
         softwareConfig?: outputs.dataproc.WorkflowTemplatePlacementManagedClusterConfigSoftwareConfig;
         /**
-         * A Cloud Storage bucket used to stage job dependencies, config files, and job driver console output. If you do not specify a staging bucket, Cloud Dataproc will determine a Cloud Storage location (US, ASIA, or EU) for your cluster's staging bucket according to the Compute Engine zone where your cluster is deployed, and then create and manage this project-level, per-location bucket (see [Dataproc staging and temp buckets](https://cloud.google.com/dataproc/docs/concepts/configuring-clusters/staging-bucket)).
+         * A Cloud Storage bucket used to stage job dependencies, config files, and job driver console output. If you do not specify a staging bucket, Cloud Dataproc will determine a Cloud Storage location (US, ASIA, or EU) for your cluster's staging bucket according to the Compute Engine zone where your cluster is deployed, and then create and manage this project-level, per-location bucket (see [Dataproc staging and temp buckets](https://docs.cloud.google.com/dataproc/docs/concepts/configuring-clusters/staging-bucket)).
          */
         stagingBucket?: string;
         /**
@@ -78911,7 +80141,7 @@ export declare namespace dataproc {
          */
         internalIpOnly: boolean;
         /**
-         * The Compute Engine metadata entries to add to all instances (see [About VM metadata](https://cloud.google.com/compute/docs/metadata/overview)).
+         * The Compute Engine metadata entries to add to all instances (see [About VM metadata](https://docs.cloud.google.com/compute/docs/metadata/overview)).
          */
         metadata?: {
             [key: string]: string;
@@ -78933,15 +80163,15 @@ export declare namespace dataproc {
          */
         reservationAffinity?: outputs.dataproc.WorkflowTemplatePlacementManagedClusterConfigGceClusterConfigReservationAffinity;
         /**
-         * The (https://cloud.google.com/compute/docs/access/service-accounts#default_service_account) is used.
+         * The (https://docs.cloud.google.com/compute/docs/access/service-accounts#default_service_account) is used.
          */
         serviceAccount?: string;
         /**
-         * The URIs of service account scopes to be included in Compute Engine instances. The following base set of scopes is always included: * https://www.googleapis.com/auth/cloud.useraccounts.readonly * https://www.googleapis.com/auth/devstorage.read_write * https://www.googleapis.com/auth/logging.write If no scopes are specified, the following defaults are also provided: * https://www.googleapis.com/auth/bigquery * https://www.googleapis.com/auth/bigtable.admin.table * https://www.googleapis.com/auth/bigtable.data * https://www.googleapis.com/auth/devstorage.full_control
+         * The URIs of service account scopes to be included in Compute Engine instances. The following base set of scopes is always included: * https://www.googleapis.com/auth/docs.cloud.useraccounts.readonly * https://www.googleapis.com/auth/devstorage.read_write * https://www.googleapis.com/auth/logging.write If no scopes are specified, the following defaults are also provided: * https://www.googleapis.com/auth/bigquery * https://www.googleapis.com/auth/bigtable.admin.table * https://www.googleapis.com/auth/bigtable.data * https://www.googleapis.com/auth/devstorage.full_control
          */
         serviceAccountScopes?: string[];
         /**
-         * Shielded Instance Config for clusters using [Compute Engine Shielded VMs](https://cloud.google.com/security/shielded-cloud/shielded-vm). Structure defined below.
+         * Shielded Instance Config for clusters using [Compute Engine Shielded VMs](https://docs.cloud.google.com/security/shielded-cloud/shielded-vm). Structure defined below.
          */
         shieldedInstanceConfig?: outputs.dataproc.WorkflowTemplatePlacementManagedClusterConfigGceClusterConfigShieldedInstanceConfig;
         /**
@@ -78949,7 +80179,7 @@ export declare namespace dataproc {
          */
         subnetwork?: string;
         /**
-         * The Compute Engine tags to add to all instances (see [Manage tags for resources](https://cloud.google.com/compute/docs/tag-resources)).
+         * The Compute Engine tags to add to all instances (see [Manage tags for resources](https://docs.cloud.google.com/compute/docs/tag-resources)).
          */
         tags?: string[];
         /**
@@ -78979,15 +80209,15 @@ export declare namespace dataproc {
     }
     interface WorkflowTemplatePlacementManagedClusterConfigGceClusterConfigShieldedInstanceConfig {
         /**
-         * Defines whether instances have [Integrity Monitoring](https://cloud.google.com/compute/shielded-vm/docs/shielded-vm#integrity-monitoring) enabled.
+         * Defines whether instances have [Integrity Monitoring](https://docs.cloud.google.com/compute/shielded-vm/docs/shielded-vm#integrity-monitoring) enabled.
          */
         enableIntegrityMonitoring?: boolean;
         /**
-         * Defines whether instances have [Secure Boot](https://cloud.google.com/compute/shielded-vm/docs/shielded-vm#secure-boot) enabled.
+         * Defines whether instances have [Secure Boot](https://docs.cloud.google.com/compute/shielded-vm/docs/shielded-vm#secure-boot) enabled.
          */
         enableSecureBoot?: boolean;
         /**
-         * Defines whether instances have the [vTPM](https://cloud.google.com/compute/shielded-vm/docs/shielded-vm#vtpm) enabled.
+         * Defines whether instances have the [vTPM](https://docs.cloud.google.com/compute/shielded-vm/docs/shielded-vm#vtpm) enabled.
          */
         enableVtpm?: boolean;
     }
@@ -79057,7 +80287,7 @@ export declare namespace dataproc {
          */
         isPreemptible: boolean;
         /**
-         * The Compute Engine machine type used for cluster instances. A full URL, partial URI, or short name are valid. Examples: * `https://www.googleapis.com/compute/v1/projects/(https://cloud.google.com/dataproc/docs/concepts/configuring-clusters/auto-zone#using_auto_zone_placement) feature, you must use the short name of the machine type resource, for example, `n1-standard-2`.
+         * The Compute Engine machine type used for cluster instances. A full URL, partial URI, or short name are valid. Examples: * `https://www.googleapis.com/compute/v1/projects/(https://docs.cloud.google.com/dataproc/docs/concepts/configuring-clusters/auto-zone#using_auto_zone_placement) feature, you must use the short name of the machine type resource, for example, `n1-standard-2`.
          */
         machineType?: string;
         /**
@@ -79065,7 +80295,7 @@ export declare namespace dataproc {
          */
         managedGroupConfigs: outputs.dataproc.WorkflowTemplatePlacementManagedClusterConfigMasterConfigManagedGroupConfig[];
         /**
-         * Specifies the minimum cpu platform for the Instance Group. See [Minimum CPU platform](https://cloud.google.com/dataproc/docs/concepts/compute/dataproc-min-cpu).
+         * Specifies the minimum cpu platform for the Instance Group. See [Minimum CPU platform](https://docs.cloud.google.com/dataproc/docs/concepts/compute/dataproc-min-cpu).
          */
         minCpuPlatform: string;
         /**
@@ -79083,7 +80313,7 @@ export declare namespace dataproc {
          */
         acceleratorCount?: number;
         /**
-         * Full URL, partial URI, or short name of the accelerator type resource to expose to this instance. See (https://cloud.google.com/dataproc/docs/concepts/configuring-clusters/auto-zone#using_auto_zone_placement) feature, you must use the short name of the accelerator type resource, for example, `nvidia-tesla-k80`.
+         * Full URL, partial URI, or short name of the accelerator type resource to expose to this instance. See (https://docs.cloud.google.com/dataproc/docs/concepts/configuring-clusters/auto-zone#using_auto_zone_placement) feature, you must use the short name of the accelerator type resource, for example, `nvidia-tesla-k80`.
          */
         acceleratorType?: string;
     }
@@ -79165,7 +80395,7 @@ export declare namespace dataproc {
          */
         acceleratorCount?: number;
         /**
-         * Full URL, partial URI, or short name of the accelerator type resource to expose to this instance. See (https://cloud.google.com/dataproc/docs/concepts/configuring-clusters/auto-zone#using_auto_zone_placement) feature, you must use the short name of the accelerator type resource, for example, `nvidia-tesla-k80`.
+         * Full URL, partial URI, or short name of the accelerator type resource to expose to this instance. See (https://docs.cloud.google.com/dataproc/docs/concepts/configuring-clusters/auto-zone#using_auto_zone_placement) feature, you must use the short name of the accelerator type resource, for example, `nvidia-tesla-k80`.
          */
         acceleratorType?: string;
     }
@@ -79263,7 +80493,7 @@ export declare namespace dataproc {
     }
     interface WorkflowTemplatePlacementManagedClusterConfigSoftwareConfig {
         /**
-         * The version of software inside the cluster. It must be one of the supported [Dataproc Versions](https://cloud.google.com/dataproc/docs/concepts/versioning/dataproc-versions#supported_dataproc_versions), such as "1.2" (including a subminor version, such as "1.2.29"), or the ["preview" version](https://cloud.google.com/dataproc/docs/concepts/versioning/dataproc-versions#other_versions). If unspecified, it defaults to the latest Debian version.
+         * The version of software inside the cluster. It must be one of the supported [Dataproc Versions](https://docs.cloud.google.com/dataproc/docs/concepts/versioning/dataproc-versions#supported_dataproc_versions), such as "1.2" (including a subminor version, such as "1.2.29"), or the ["preview" version](https://docs.cloud.google.com/dataproc/docs/concepts/versioning/dataproc-versions#other_versions). If unspecified, it defaults to the latest Debian version.
          */
         imageVersion?: string;
         /**
@@ -79286,7 +80516,7 @@ export declare namespace dataproc {
          * * yarn: `yarn-site.xml`
          *
          *
-         * For more information, see [Cluster properties](https://cloud.google.com/dataproc/docs/concepts/cluster-properties).
+         * For more information, see [Cluster properties](https://docs.cloud.google.com/dataproc/docs/concepts/cluster-properties).
          */
         properties?: {
             [key: string]: string;
@@ -79340,7 +80570,7 @@ export declare namespace dataproc {
          */
         acceleratorCount?: number;
         /**
-         * Full URL, partial URI, or short name of the accelerator type resource to expose to this instance. See (https://cloud.google.com/dataproc/docs/concepts/configuring-clusters/auto-zone#using_auto_zone_placement) feature, you must use the short name of the accelerator type resource, for example, `nvidia-tesla-k80`.
+         * Full URL, partial URI, or short name of the accelerator type resource to expose to this instance. See (https://docs.cloud.google.com/dataproc/docs/concepts/configuring-clusters/auto-zone#using_auto_zone_placement) feature, you must use the short name of the accelerator type resource, for example, `nvidia-tesla-k80`.
          */
         acceleratorType?: string;
     }
@@ -82161,6 +83391,12 @@ export declare namespace developerconnect {
          */
         deployment: string;
     }
+    interface InsightsConfigTargetProjects {
+        /**
+         * The project IDs. Format {project}.
+         */
+        projectIds?: string[];
+    }
 }
 export declare namespace diagflow {
     interface ConversationProfileAutomatedAgentConfig {
@@ -87455,6 +88691,43 @@ export declare namespace discoveryengine {
          */
         companyName?: string;
     }
+    interface SearchEngineKnowledgeGraphConfig {
+        /**
+         * Specify entity types to support.
+         */
+        cloudKnowledgeGraphTypes?: string[];
+        /**
+         * Whether to enable the Cloud Knowledge Graph for the engine.
+         */
+        enableCloudKnowledgeGraph: boolean;
+        /**
+         * Whether to enable the Private Knowledge Graph for the engine.
+         */
+        enablePrivateKnowledgeGraph: boolean;
+        /**
+         * Feature config for the Knowledge Graph.
+         * Structure is documented below.
+         */
+        featureConfig?: outputs.discoveryengine.SearchEngineKnowledgeGraphConfigFeatureConfig;
+    }
+    interface SearchEngineKnowledgeGraphConfigFeatureConfig {
+        /**
+         * Whether to disable the private KG auto complete for the engine.
+         */
+        disablePrivateKgAutoComplete?: boolean;
+        /**
+         * Whether to disable the private KG enrichment for the engine.
+         */
+        disablePrivateKgEnrichment?: boolean;
+        /**
+         * Whether to disable the private KG for query UI chips.
+         */
+        disablePrivateKgQueryUiChips?: boolean;
+        /**
+         * Whether to disable the private KG query understanding for the engine.
+         */
+        disablePrivateKgQueryUnderstanding?: boolean;
+    }
     interface SearchEngineSearchEngineConfig {
         /**
          * The add-on that this search engine enables.
@@ -87956,6 +89229,14 @@ export declare namespace dns {
          * Structure is documented below.
          */
         gkeClusters?: outputs.dns.ManagedZonePrivateVisibilityConfigGkeCluster[];
+        /**
+         * The list of VPC networks that can see this zone. Until the provider updates to use the Terraform 0.12 SDK in a future release, you
+         * may experience issues with this resource while updating. If you've defined a `networks` block and
+         * add another `networks` block while keeping the old block, Terraform will see an incorrect diff
+         * and apply an incorrect update to the resource. If you encounter this issue, remove all `networks`
+         * blocks in an update and then apply another update adding all of them back simultaneously.
+         * Structure is documented below.
+         */
         networks?: outputs.dns.ManagedZonePrivateVisibilityConfigNetwork[];
     }
     interface ManagedZonePrivateVisibilityConfigGkeCluster {
@@ -88145,6 +89426,10 @@ export declare namespace dns {
          * The location name defined in Google Cloud.
          */
         location: string;
+        /**
+         * The string data for the records in this record set
+         * whose meaning depends on the DNS type. For TXT record, if the string data contains spaces, add surrounding `\"` if you don't want your string to get split on spaces. To specify a single record value longer than 255 characters such as a TXT record for DKIM, add `\" \"` inside the Terraform configuration string (e.g. `"first255characters\" \"morecharacters"`).
+         */
         rrdatas?: string[];
     }
     interface RecordSetRoutingPolicyPrimaryBackupBackupGeoHealthCheckedTargets {
@@ -90005,25 +91290,28 @@ export declare namespace firebase {
     interface AiLogicConfigGenerativeLanguageConfig {
         /**
          * The value of the API key. The API key must have
-         * 'generativelanguage.googleapis.com' in its "API restrictions" allowlist.
+         * `generativelanguage.googleapis.com` in its "API restrictions" allowlist.
          * Note that this API is sometimes called the *Generative Language API* in
          * the Google Cloud console.
-         *
          * Do **not** add this Gemini API key into your app's codebase
+         * **Note**: This property is sensitive and will not be displayed in the plan.
          */
         apiKey?: string;
         /**
          * **NOTE:** This field is write-only and its value will not be updated in state as part of read operations.
+         * (Optional, Write-Only)
          * The value of the API key. The API key must have
-         * 'generativelanguage.googleapis.com' in its "API restrictions" allowlist.
+         * `generativelanguage.googleapis.com` in its "API restrictions" allowlist.
          * Note that this API is sometimes called the *Generative Language API* in
          * the Google Cloud console.
-         *
          * Do **not** add this Gemini API key into your app's codebase
+         * **Note**: This property is write-only and will not be read from the API.
+         *
+         * > **Note:** One of `apiKey` or `apiKeyWo` can only be set.
          */
         apiKeyWo?: string;
         /**
-         * Triggers update of 'api_key_wo' write-only. Increment this value when an update to 'api_key_wo' is needed. For more info see [updating write-only arguments](https://www.terraform.io/docs/providers/google/guides/using_write_only_arguments.html#updating-write-only-arguments)
+         * Triggers update of `apiKeyWo` write-only. Increment this value when an update to `apiKeyWo` is needed. For more info see [updating write-only arguments](https://www.terraform.io/docs/providers/google/guides/using_write_only_arguments.html#updating-write-only-arguments)
          */
         apiKeyWoVersion?: string;
     }
@@ -92249,7 +93537,9 @@ export declare namespace gkehub {
          */
         hierarchyController?: outputs.gkehub.FeatureMembershipConfigmanagementHierarchyController;
         /**
-         * Set this field to MANAGEMENT_AUTOMATIC to enable Config Sync auto-upgrades, and set this field to MANAGEMENT_MANUAL or MANAGEMENT_UNSPECIFIED to disable Config Sync auto-upgrades.
+         * Enables automatic Feature management. Set this field to MANAGEMENT_AUTOMATIC to enable Config Sync auto-upgrades,
+         * and set this field to MANAGEMENT_MANUAL or MANAGEMENT_UNSPECIFIED to disable Config Sync auto-upgrades.
+         * This field was introduced in Terraform version 5.41.0.
          */
         management: string;
         /**
@@ -92269,7 +93559,9 @@ export declare namespace gkehub {
          */
         deploymentOverrides?: outputs.gkehub.FeatureMembershipConfigmanagementConfigSyncDeploymentOverride[];
         /**
-         * Enables the installation of ConfigSync. If set to true, ConfigSync resources will be created and the other ConfigSync fields will be applied if exist. If set to false, all other ConfigSync fields will be ignored, ConfigSync resources will be deleted. If omitted, ConfigSync resources will be managed depends on the presence of the git or oci field.
+         * Whether Config Sync is enabled in the cluster. This field was introduced in Terraform version
+         * 5.41.0, and
+         * needs to be set to `true` explicitly to install Config Sync.
          */
         enabled?: boolean;
         /**
@@ -93220,6 +94512,10 @@ export declare namespace gkehub {
         updateTime: string;
     }
     interface GetMembershipAuthority {
+        /**
+         * A JSON Web Token (JWT) issuer URI. 'issuer' must start with 'https://' and // be a valid
+         * with length <2000 characters. For example: 'https://container.googleapis.com/v1/projects/my-project/locations/us-west1/clusters/my-cluster'. If the cluster is provisioned with Terraform, this is '"https://container.googleapis.com/v1/${google_container_cluster.my-cluster.id}"'.
+         */
         issuer: string;
     }
     interface GetMembershipBindingState {
@@ -93235,9 +94531,20 @@ export declare namespace gkehub {
         gkeClusters: outputs.gkehub.GetMembershipEndpointGkeCluster[];
     }
     interface GetMembershipEndpointGkeCluster {
+        /**
+         * Self-link of the GCP resource for the GKE cluster.
+         * For example: '//container.googleapis.com/projects/my-project/locations/us-west1-a/clusters/my-cluster'.
+         * It can be at the most 1000 characters in length. If the cluster is provisioned with Terraform,
+         * this can be '"//container.googleapis.com/${google_container_cluster.my-cluster.id}"' or
+         * 'google_container_cluster.my-cluster.id'.
+         */
         resourceLink: string;
     }
     interface MembershipAuthority {
+        /**
+         * A JSON Web Token (JWT) issuer URI. `issuer` must start with `https://` and // be a valid
+         * with length <2000 characters. For example: `https://container.googleapis.com/v1/projects/my-project/locations/us-west1/clusters/my-cluster`. If the cluster is provisioned with Terraform, this is `"https://container.googleapis.com/v1/${google_container_cluster.my-cluster.id}"`.
+         */
         issuer: string;
     }
     interface MembershipBindingState {
@@ -93255,6 +94562,13 @@ export declare namespace gkehub {
         gkeCluster?: outputs.gkehub.MembershipEndpointGkeCluster;
     }
     interface MembershipEndpointGkeCluster {
+        /**
+         * Self-link of the GCP resource for the GKE cluster.
+         * For example: `//container.googleapis.com/projects/my-project/locations/us-west1-a/clusters/my-cluster`.
+         * It can be at the most 1000 characters in length. If the cluster is provisioned with Terraform,
+         * this can be `"//container.googleapis.com/${google_container_cluster.my-cluster.id}"` or
+         * `google_container_cluster.my-cluster.id`.
+         */
         resourceLink: string;
     }
     interface MembershipIamBindingCondition {
@@ -96942,6 +98256,13 @@ export declare namespace iam {
         idpMetadataXml: string;
     }
     interface WorkloadIdentityPoolIamBindingCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -96953,6 +98274,13 @@ export declare namespace iam {
         title: string;
     }
     interface WorkloadIdentityPoolIamMemberCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -97442,6 +98770,13 @@ export declare namespace iap {
         rctokenAud?: string;
     }
     interface TunnelDestGroupIamBindingCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -97453,6 +98788,13 @@ export declare namespace iap {
         title: string;
     }
     interface TunnelDestGroupIamMemberCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -97564,6 +98906,13 @@ export declare namespace iap {
         title: string;
     }
     interface WebCloudRunServiceIamBindingCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -97575,6 +98924,13 @@ export declare namespace iap {
         title: string;
     }
     interface WebCloudRunServiceIamMemberCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -97586,6 +98942,13 @@ export declare namespace iap {
         title: string;
     }
     interface WebForwardingRuleServiceIamBindingCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -97597,6 +98960,13 @@ export declare namespace iap {
         title: string;
     }
     interface WebForwardingRuleServiceIamMemberCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -97644,6 +99014,13 @@ export declare namespace iap {
         title: string;
     }
     interface WebRegionBackendServiceIamBindingCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -97655,6 +99032,13 @@ export declare namespace iap {
         title: string;
     }
     interface WebRegionBackendServiceIamMemberCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -97666,6 +99050,13 @@ export declare namespace iap {
         title: string;
     }
     interface WebRegionForwardingRuleServiceIamBindingCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -97677,6 +99068,13 @@ export declare namespace iap {
         title: string;
     }
     interface WebRegionForwardingRuleServiceIamMemberCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -98947,6 +100345,13 @@ export declare namespace kms {
         protectionLevel?: string;
     }
     interface EkmConnectionIamBindingCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -98958,6 +100363,13 @@ export declare namespace kms {
         title: string;
     }
     interface EkmConnectionIamMemberCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -99102,6 +100514,9 @@ export declare namespace kms {
          * If not specified at creation time, the default duration is 30 days.
          */
         destroyScheduledDuration: string;
+        /**
+         * All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
+         */
         effectiveLabels: {
             [key: string]: string;
         };
@@ -99516,6 +100931,13 @@ export declare namespace logging {
         datasetId: string;
     }
     interface LogViewIamBindingCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -99527,6 +100949,13 @@ export declare namespace logging {
         title: string;
     }
     interface LogViewIamMemberCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -99815,6 +101244,13 @@ export declare namespace logging {
 }
 export declare namespace looker {
     interface InstanceAdminSettings {
+        /**
+         * Email domain allowlist for the instance.
+         * Define the email domains to which your users can deliver Looker (Google Cloud core) content.
+         * Updating this list will restart the instance. Updating the allowed email domains from terraform
+         * means the value provided will be considered as the entire list and not an amendment to the
+         * existing list of allowed email domains.
+         */
         allowedEmailDomains?: string[];
     }
     interface InstanceControlledEgressConfig {
@@ -102392,6 +103828,14 @@ export declare namespace monitoring {
          * valid Prometheus label name.
          */
         alertRule?: string;
+        /**
+         * Whether to disable metric existence validation for this condition.
+         * This allows alerting policies to be defined on metrics that do not yet
+         * exist, improving advanced customer workflows such as configuring
+         * alerting policies using Terraform.
+         * Users with the `monitoring.alertPolicyViewer` role are able to see the
+         * name of the non-existent metric in the alerting policy condition.
+         */
         disableMetricValidation?: boolean;
         /**
          * Alerts are considered firing once their PromQL expression evaluated
@@ -103010,14 +104454,38 @@ export declare namespace monitoring {
          * An authorization token for a notification channel. Channel types that support this field include: slack
          */
         authToken: string;
+        /**
+         * An authorization token for a notification channel. Channel types that support this field include: slack
+         */
+        authTokenWo: string;
+        /**
+         * Triggers update of 'auth_token_wo' write-only. Increment this value when an update to 'auth_token_wo' is needed. For more info see [updating write-only arguments](https://www.terraform.io/docs/providers/google/guides/using_write_only_arguments.html#updating-write-only-arguments)
+         */
+        authTokenWoVersion: string;
         /**
          * An password for a notification channel. Channel types that support this field include: webhook_basicauth
          */
         password: string;
+        /**
+         * An password for a notification channel. Channel types that support this field include: webhook_basicauth
+         */
+        passwordWo: string;
+        /**
+         * Triggers update of 'password_wo' write-only. Increment this value when an update to 'password_wo' is needed. For more info see [updating write-only arguments](https://www.terraform.io/docs/providers/google/guides/using_write_only_arguments.html#updating-write-only-arguments)
+         */
+        passwordWoVersion: string;
         /**
          * An servicekey token for a notification channel. Channel types that support this field include: pagerduty
          */
         serviceKey: string;
+        /**
+         * An servicekey token for a notification channel. Channel types that support this field include: pagerduty
+         */
+        serviceKeyWo: string;
+        /**
+         * Triggers update of 'service_key_wo' write-only. Increment this value when an update to 'service_key_wo' is needed. For more info see [updating write-only arguments](https://www.terraform.io/docs/providers/google/guides/using_write_only_arguments.html#updating-write-only-arguments)
+         */
+        serviceKeyWoVersion: string;
     }
     interface GetUptimeCheckIPsUptimeCheckIp {
         /**
@@ -103069,16 +104537,55 @@ export declare namespace monitoring {
          * **Note**: This property is sensitive and will not be displayed in the plan.
          */
         authToken?: string;
+        /**
+         * **NOTE:** This field is write-only and its value will not be updated in state as part of read operations.
+         * (Optional, Write-Only)
+         * An authorization token for a notification channel. Channel types that support this field include: slack
+         * **Note**: This property is write-only and will not be read from the API.
+         *
+         * > **Note:** One of `authToken` or `authTokenWo` can only be set.
+         */
+        authTokenWo?: string;
+        /**
+         * Triggers update of `authTokenWo` write-only. Increment this value when an update to `authTokenWo` is needed. For more info see [updating write-only arguments](https://www.terraform.io/docs/providers/google/guides/using_write_only_arguments.html#updating-write-only-arguments)
+         */
+        authTokenWoVersion?: string;
         /**
          * An password for a notification channel. Channel types that support this field include: webhookBasicauth
          * **Note**: This property is sensitive and will not be displayed in the plan.
          */
         password?: string;
+        /**
+         * **NOTE:** This field is write-only and its value will not be updated in state as part of read operations.
+         * (Optional, Write-Only)
+         * An password for a notification channel. Channel types that support this field include: webhookBasicauth
+         * **Note**: This property is write-only and will not be read from the API.
+         *
+         * > **Note:** One of `password` or `passwordWo` can only be set.
+         */
+        passwordWo?: string;
+        /**
+         * Triggers update of `passwordWo` write-only. Increment this value when an update to `passwordWo` is needed. For more info see [updating write-only arguments](https://www.terraform.io/docs/providers/google/guides/using_write_only_arguments.html#updating-write-only-arguments)
+         */
+        passwordWoVersion?: string;
         /**
          * An servicekey token for a notification channel. Channel types that support this field include: pagerduty
          * **Note**: This property is sensitive and will not be displayed in the plan.
          */
         serviceKey?: string;
+        /**
+         * **NOTE:** This field is write-only and its value will not be updated in state as part of read operations.
+         * (Optional, Write-Only)
+         * An servicekey token for a notification channel. Channel types that support this field include: pagerduty
+         * **Note**: This property is write-only and will not be read from the API.
+         *
+         * > **Note:** One of `serviceKey` or `serviceKeyWo` can only be set.
+         */
+        serviceKeyWo?: string;
+        /**
+         * Triggers update of `serviceKeyWo` write-only. Increment this value when an update to `serviceKeyWo` is needed. For more info see [updating write-only arguments](https://www.terraform.io/docs/providers/google/guides/using_write_only_arguments.html#updating-write-only-arguments)
+         */
+        serviceKeyWoVersion?: string;
     }
     interface SloBasicSli {
         /**
@@ -103599,11 +105106,16 @@ export declare namespace monitoring {
     interface UptimeCheckConfigHttpCheckAuthInfo {
         /**
          * The password to authenticate.
+         * **Note**: This property is sensitive and will not be displayed in the plan.
          */
         password?: string;
         /**
          * **NOTE:** This field is write-only and its value will not be updated in state as part of read operations.
+         * (Optional, Write-Only)
          * The password to authenticate.
+         * **Note**: This property is write-only and will not be read from the API.
+         *
+         * > **Note:** One of `password` or `passwordWo` can only be set.
          */
         passwordWo?: string;
         /**
@@ -104861,6 +106373,9 @@ export declare namespace networkmanagement {
          * Structure is documented below.
          */
         destinations: outputs.networkmanagement.GetConnectivityTestsConnectivityTestDestination[];
+        /**
+         * All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
+         */
         effectiveLabels: {
             [key: string]: string;
         };
@@ -105643,6 +107158,11 @@ export declare namespace networksecurity {
          * Structure is documented below.
          */
         hosts?: outputs.networksecurity.AuthzPolicyHttpRuleToOperationHost[];
+        /**
+         * Defines the MCP protocol attributes to match on. MCP based match is allowed only when the AuthzPolicy points to an AgentGateway.
+         * Structure is documented below.
+         */
+        mcp?: outputs.networksecurity.AuthzPolicyHttpRuleToOperationMcp;
         /**
          * A list of HTTP methods to match against. Each entry must be a valid HTTP method name (GET, PUT, POST, HEAD, PATCH, DELETE, OPTIONS). It only allows exact match and is always case sensitive.
          */
@@ -105733,6 +107253,56 @@ export declare namespace networksecurity {
          */
         suffix?: string;
     }
+    interface AuthzPolicyHttpRuleToOperationMcp {
+        /**
+         * If specified, matches on the MCP protocol’s non-access specific methods namely: * initialize/ * completion/ * logging/ * notifications/ * ping
+         * Default value is `SKIP_BASE_PROTOCOL_METHODS`.
+         * Possible values are: `SKIP_BASE_PROTOCOL_METHODS`, `MATCH_BASE_PROTOCOL_METHODS`.
+         */
+        baseProtocolMethodsOption?: string;
+        /**
+         * Defines a set of MCP methods and associated parameters to match on. It is recommended to use this field to match on tools, prompts and resource accesses while setting the includeBaseProtocolMethods to true to match on all the other MCP protocol methods.
+         * Structure is documented below.
+         */
+        methods?: outputs.networksecurity.AuthzPolicyHttpRuleToOperationMcpMethod[];
+    }
+    interface AuthzPolicyHttpRuleToOperationMcpMethod {
+        /**
+         * The MCP method to match against. Allowed values are as follows:
+         * 1) “tools”, “prompts”, “resources” - these will match against all sub methods under the respective methods.
+         * 2) “prompts/list”, “tools/list”, “resources/list”, “resources/templates/list”
+         * 3) “prompts/get”, “tools/call”, “resources/subscribe”, “resources/unsubscribe”, “resources/read”
+         * Params cannot be specified for categories 1) and 2).
+         */
+        name: string;
+        /**
+         * MCP method parameters to match against.
+         * Structure is documented below.
+         */
+        params?: outputs.networksecurity.AuthzPolicyHttpRuleToOperationMcpMethodParam[];
+    }
+    interface AuthzPolicyHttpRuleToOperationMcpMethodParam {
+        /**
+         * A substring match on the MCP method parameter name.
+         */
+        contains?: string;
+        /**
+         * An exact match on the MCP method parameter name.
+         */
+        exact?: string;
+        /**
+         * Specifies that the string match should be case insensitive.
+         */
+        ignoreCase?: boolean;
+        /**
+         * A prefix match on the MCP method parameter name.
+         */
+        prefix?: string;
+        /**
+         * A suffix match on the MCP method parameter name.
+         */
+        suffix?: string;
+    }
     interface AuthzPolicyHttpRuleToOperationPath {
         /**
          * The input string must have the substring specified here. Note: empty contains match is not allowed, please use regex instead.
@@ -105765,13 +107335,15 @@ export declare namespace networksecurity {
     }
     interface AuthzPolicyTarget {
         /**
-         * All gateways and forwarding rules referenced by this policy and extensions must share the same load balancing scheme.
+         * Required when targeting forwarding rules and secure web proxy. Must not be specified when targeting Agent
+         * Gateway. All resources referenced by this policy and extensions must share the same load balancing scheme.
          * For more information, refer to [Backend services overview](https://cloud.google.com/load-balancing/docs/backend-service).
          * Possible values are: `INTERNAL_MANAGED`, `EXTERNAL_MANAGED`, `INTERNAL_SELF_MANAGED`.
          */
-        loadBalancingScheme: string;
+        loadBalancingScheme?: string;
         /**
-         * A list of references to the Forwarding Rules on which this policy will be applied.
+         * A list of references to the Forwarding Rules or Secure Web Proxy Gateways or Agent Gateways on which this
+         * policy will be applied.
          */
         resources?: string[];
     }
@@ -106276,6 +107848,50 @@ export declare namespace networksecurity {
     }
 }
 export declare namespace networkservices {
+    interface AgentGatewayAgentGatewayCard {
+        /**
+         * (Output)
+         * mTLS Endpoint associated with this AgentGateway.
+         */
+        mtlsEndpoint: string;
+        /**
+         * (Output)
+         * Root Certificates for Agents to validate this AgentGateway.
+         */
+        rootCertificates: string[];
+        /**
+         * (Output)
+         * Service Account used by Service Extensions to operate.
+         */
+        serviceExtensionsServiceAccount: string;
+    }
+    interface AgentGatewayGoogleManaged {
+        /**
+         * Operating Mode of Agent Gateway.
+         * Possible values are: `AGENT_TO_ANYWHERE`, `CLIENT_TO_AGENT`.
+         */
+        governedAccessPath: string;
+    }
+    interface AgentGatewayNetworkConfig {
+        /**
+         * Optional PSC-Interface network attachment for connectivity to your
+         * private VPCs network.
+         * Structure is documented below.
+         */
+        egress: outputs.networkservices.AgentGatewayNetworkConfigEgress;
+    }
+    interface AgentGatewayNetworkConfigEgress {
+        /**
+         * The URI of the Network Attachment resource.
+         */
+        networkAttachment: string;
+    }
+    interface AgentGatewaySelfManaged {
+        /**
+         * A supported Google Cloud networking proxy in the Project and Location.
+         */
+        resourceUri: string;
+    }
     interface EdgeCacheKeysetPublicKey {
         /**
          * The ID of the public key. The ID must be 1-63 characters long, and comply with RFC1035.
@@ -107844,6 +109460,12 @@ export declare namespace networkservices {
          */
         state: string;
     }
+    interface MulticastDomainUllMulticastDomain {
+        /**
+         * The preconfigured Ultra-Low-Latency domain name.
+         */
+        preconfiguredUllDomain?: string;
+    }
     interface MulticastGroupConsumerActivationLogConfig {
         /**
          * Whether to enable logging or not.
@@ -110142,6 +111764,154 @@ export declare namespace oracledatabase {
          */
         id: string;
     }
+    interface ExadbVmClusterProperties {
+        /**
+         * The number of additional ECPUs per node for an Exadata VM cluster on
+         * exascale infrastructure.
+         */
+        additionalEcpuCountPerNode: number;
+        /**
+         * The cluster name for Exascale vm cluster. The cluster name must begin with
+         * an alphabetic character and may contain hyphens(-) but can not contain
+         * underscores(_). It should be not more than 11 characters and is not case
+         * sensitive.
+         * OCI Cluster name.
+         */
+        clusterName: string;
+        /**
+         * Data collection options for diagnostics.
+         * https://docs.oracle.com/en-us/iaas/api/#/en/database/20160918/datatypes/DataCollectionOptions
+         * Structure is documented below.
+         */
+        dataCollectionOptions: outputs.oracledatabase.ExadbVmClusterPropertiesDataCollectionOptions;
+        /**
+         * The number of ECPUs enabled per node for an exadata vm cluster on
+         * exascale infrastructure.
+         */
+        enabledEcpuCountPerNode: number;
+        /**
+         * The name of ExascaleDbStorageVault associated with the ExadbVmCluster.
+         * It can refer to an existing ExascaleDbStorageVault. Or a new one can be
+         * created during the ExadbVmCluster creation (requires
+         * storageVaultProperties to be set).
+         * Format:
+         * projects/{project}/locations/{location}/exascaleDbStorageVaults/{exascale_db_storage_vault}
+         */
+        exascaleDbStorageVault: string;
+        /**
+         * (Output)
+         * The Oracle Grid Infrastructure (GI) software version.
+         */
+        giVersion: string;
+        /**
+         * Grid Infrastructure Version.
+         */
+        gridImageId: string;
+        /**
+         * (Output)
+         * The hostname of the ExadbVmCluster.
+         */
+        hostname: string;
+        /**
+         * Prefix for VM cluster host names.
+         */
+        hostnamePrefix: string;
+        /**
+         * The license type of the ExadbVmCluster.
+         * Possible values:
+         * LICENSE_INCLUDED
+         * BRING_YOUR_OWN_LICENSE
+         */
+        licenseModel: string;
+        /**
+         * (Output)
+         * State of the cluster.
+         * Possible values:
+         * PROVISIONING
+         * AVAILABLE
+         * UPDATING
+         * TERMINATING
+         * TERMINATED
+         * FAILED
+         * MAINTENANCE_IN_PROGRESS
+         */
+        lifecycleState: string;
+        /**
+         * (Output)
+         * Memory per VM (GB) (Read-only): Shows the amount of memory allocated to
+         * each VM. Memory is calculated based on 2.75 GB per Total ECPUs.
+         */
+        memorySizeGb: number;
+        /**
+         * The number of nodes/VMs in the ExadbVmCluster.
+         */
+        nodeCount: number;
+        /**
+         * (Output)
+         * Deep link to the OCI console to view this resource.
+         */
+        ociUri: string;
+        /**
+         * SCAN listener port - TCP
+         */
+        scanListenerPortTcp: number;
+        /**
+         * The shape attribute of the VM cluster. The type of Exascale storage used
+         * for Exadata VM cluster. The default is SMART_STORAGE which supports Oracle
+         * Database 23ai and later
+         * Possible values:
+         * SMART_STORAGE
+         * BLOCK_STORAGE
+         */
+        shapeAttribute: string;
+        /**
+         * The SSH public keys for the ExadbVmCluster.
+         */
+        sshPublicKeys: string[];
+        /**
+         * Represents a time zone from the
+         * [IANA Time Zone Database](https://www.iana.org/time-zones).
+         * Structure is documented below.
+         */
+        timeZone?: outputs.oracledatabase.ExadbVmClusterPropertiesTimeZone;
+        /**
+         * The storage allocation for the exadbvmcluster, in gigabytes (GB).
+         * Structure is documented below.
+         */
+        vmFileSystemStorage: outputs.oracledatabase.ExadbVmClusterPropertiesVmFileSystemStorage;
+    }
+    interface ExadbVmClusterPropertiesDataCollectionOptions {
+        /**
+         * Indicates whether to enable data collection for diagnostics.
+         */
+        isDiagnosticsEventsEnabled: boolean;
+        /**
+         * Indicates whether to enable health monitoring.
+         */
+        isHealthMonitoringEnabled: boolean;
+        /**
+         * Indicates whether to enable incident logs and trace collection.
+         */
+        isIncidentLogsEnabled: boolean;
+    }
+    interface ExadbVmClusterPropertiesTimeZone {
+        /**
+         * IANA Time Zone Database time zone. For example "America/New_York".
+         */
+        id?: string;
+        /**
+         * IANA Time Zone Database version number. For example "2019a".
+         */
+        version?: string;
+    }
+    interface ExadbVmClusterPropertiesVmFileSystemStorage {
+        /**
+         * The storage allocation for the exadbvmcluster per node, in gigabytes (GB).
+         * This field is used to calculate the total storage allocation for the
+         * exadbvmcluster.
+         */
+        sizeInGbsPerNode: number;
+    }
     interface ExascaleDbStorageVaultProperties {
         /**
          * The size of additional flash cache in percentage of high capacity
@@ -110894,6 +112664,9 @@ export declare namespace oracledatabase {
          * contain a maximum of 30 alphanumeric characters.
          */
         database: string;
+        /**
+         * Whether or not to allow Terraform to destroy the instance. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the instance will fail.
+         */
         deletionProtection: boolean;
         /**
          * List of supported GCP region to clone the Autonomous Database for disaster recovery.
@@ -110904,6 +112677,9 @@ export declare namespace oracledatabase {
          * be unique within your project.
          */
         displayName: string;
+        /**
+         * All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
+         */
         effectiveLabels: {
             [key: string]: string;
         };
@@ -111826,11 +113602,17 @@ export declare namespace oracledatabase {
          * The date and time that the Exadata Infrastructure was created.
          */
         createTime: string;
+        /**
+         * Whether or not to allow Terraform to destroy the instance. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the instance will fail.
+         */
         deletionProtection: boolean;
         /**
          * User friendly name for this resource.
          */
         displayName: string;
+        /**
+         * All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
+         */
         effectiveLabels: {
             [key: string]: string;
         };
@@ -112280,11 +114062,17 @@ export declare namespace oracledatabase {
          * The date and time that the VM cluster was created.
          */
         createTime: string;
+        /**
+         * Whether Terraform will be prevented from destroying the cluster. Deleting this cluster via terraform destroy or terraform apply will only succeed if this field is false in the Terraform state.
+         */
         deletionProtection: boolean;
         /**
          * User friendly name for this resource.
          */
         displayName: string;
+        /**
+         * All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
+         */
         effectiveLabels: {
             [key: string]: string;
         };
@@ -118409,6 +120197,9 @@ export declare namespace parametermanager {
          * The time at which the parameter was created.
          */
         createTime: string;
+        /**
+         * All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
+         */
         effectiveLabels: {
             [key: string]: string;
         };
@@ -118489,6 +120280,9 @@ export declare namespace parametermanager {
          * The time at which the regional parameter was created.
          */
         createTime: string;
+        /**
+         * All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
+         */
         effectiveLabels: {
             [key: string]: string;
         };
@@ -121604,6 +123398,10 @@ export declare namespace runtimeconfig {
 }
 export declare namespace saasruntime {
     interface ReleaseBlueprint {
+        /**
+         * (Output)
+         * Type of the engine used to actuate the blueprint. e.g. terraform, helm etc.
+         */
         engine: string;
         /**
          * URI to a blueprint used by the Unit (required unless unitKind or release is
@@ -122025,10 +123823,21 @@ export declare namespace secretmanager {
          * Structure is documented below.
          */
         customerManagedEncryptions: outputs.secretmanager.GetRegionalSecretsSecretCustomerManagedEncryption[];
+        /**
+         * Whether Terraform will be prevented from destroying the regional secret. Defaults to false.
+         * When the field is set to true in Terraform state, a 'terraform apply'
+         * or 'terraform destroy' that would delete the federation will fail.
+         */
         deletionProtection: boolean;
+        /**
+         * All of annotations (key/value pairs) present on the resource in GCP, including the annotations configured through Terraform, other clients and services.
+         */
         effectiveAnnotations: {
             [key: string]: string;
         };
+        /**
+         * All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
+         */
         effectiveLabels: {
             [key: string]: string;
         };
@@ -122197,10 +124006,21 @@ export declare namespace secretmanager {
          * The time at which the Secret was created.
          */
         createTime: string;
+        /**
+         * Whether Terraform will be prevented from destroying the secret. Defaults to false.
+         * When the field is set to true in Terraform state, a 'terraform apply'
+         * or 'terraform destroy' that would delete the secret will fail.
+         */
         deletionProtection: boolean;
+        /**
+         * All of annotations (key/value pairs) present on the resource in GCP, including the annotations configured through Terraform, other clients and services.
+         */
         effectiveAnnotations: {
             [key: string]: string;
         };
+        /**
+         * All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
+         */
         effectiveLabels: {
             [key: string]: string;
         };
@@ -122345,6 +124165,13 @@ export declare namespace secretmanager {
         kmsKeyName: string;
     }
     interface RegionalSecretIamBindingCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -122356,6 +124183,13 @@ export declare namespace secretmanager {
         title: string;
     }
     interface RegionalSecretIamMemberCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -122397,6 +124231,13 @@ export declare namespace secretmanager {
         kmsKeyVersionName: string;
     }
     interface SecretIamBindingCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -122408,6 +124249,13 @@ export declare namespace secretmanager {
         title: string;
     }
     interface SecretIamMemberCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -123937,8 +125785,7 @@ export declare namespace spanner {
         /**
          * The encryption type of backups created by the backup schedule.
          * Possible values are USE_DATABASE_ENCRYPTION, GOOGLE_DEFAULT_ENCRYPTION, or CUSTOMER_MANAGED_ENCRYPTION.
-         * If you use CUSTOMER_MANAGED_ENCRYPTION, you must specify a kmsKeyName.
-         * If your backup type is incremental-backup, the encryption type must be GOOGLE_DEFAULT_ENCRYPTION.
+         * If you use CUSTOMER_MANAGED_ENCRYPTION, you must specify a kmsKeyName or kmsKeyNames.
          * Possible values are: `USE_DATABASE_ENCRYPTION`, `GOOGLE_DEFAULT_ENCRYPTION`, `CUSTOMER_MANAGED_ENCRYPTION`.
          */
         encryptionType: string;
@@ -123993,6 +125840,13 @@ export declare namespace spanner {
         kmsKeyNames: string[];
     }
     interface DatabaseIAMBindingCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -124004,6 +125858,13 @@ export declare namespace spanner {
         title: string;
     }
     interface DatabaseIAMMemberCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -124499,7 +126360,7 @@ export declare namespace sql {
         dataDiskProvisionedThroughput: number;
         databaseFlags?: outputs.sql.DatabaseInstanceSettingsDatabaseFlag[];
         /**
-         * Configuration to protect against accidental instance deletion.
+         * Enables deletion protection of an instance at the GCP level. Enabling this protection will guard against accidental deletion across all surfaces (API, gcloud, Cloud Console and Terraform) by enabling the [GCP Cloud SQL instance deletion protection](https://cloud.google.com/sql/docs/postgres/deletion-protection). Terraform provider support was introduced in version 4.48.0. Defaults to `false`.
          */
         deletionProtectionEnabled?: boolean;
         denyMaintenancePeriod?: outputs.sql.DatabaseInstanceSettingsDenyMaintenancePeriod;
@@ -125607,6 +127468,9 @@ export declare namespace sql {
          * To filter out the Cloud SQL instances which are of the specified database version.
          */
         databaseVersion: string;
+        /**
+         * Used to block Terraform from deleting a SQL Instance. Defaults to true.
+         */
         deletionProtection: boolean;
         /**
          * The instance-level dns name of the instance for PSC instances or public IP CAS instances.
@@ -125621,6 +127485,9 @@ export declare namespace sql {
          * The description of final backup if instance enable create final backup during instance deletion.
          */
         finalBackupDescription: string;
+        /**
+         * The first IPv4 address of any type assigned. This is to support accessing the first address in the list in a terraform output when the resource is configured with a count.
+         */
         firstIpAddress: string;
         /**
          * The type of the instance. See https://cloud.google.com/sql/docs/mysql/admin-api/rest/v1/instances#SqlInstanceType for supported values.
@@ -125635,6 +127502,9 @@ export declare namespace sql {
          * The name of the instance that will act as the master in the replication setup. Note, this requires the master to have binaryLogEnabled set, as well as existing backups.
          */
         masterInstanceName: string;
+        /**
+         * The name of the instance. If the name is left blank, Terraform will randomly generate one when the instance is first created. This is done because after a name is used, it cannot be reused for up to one week.
+         */
         name: string;
         /**
          * For a read pool instance, the number of nodes in the read pool. For read pools with auto scaling enabled, this field is read only.
@@ -125644,6 +127514,9 @@ export declare namespace sql {
          * Configuration for creating a new instance using point-in-time-restore from backupdr backup.
          */
         pointInTimeRestoreContexts: outputs.sql.GetDatabaseInstancesInstancePointInTimeRestoreContext[];
+        /**
+         * IPv4 address assigned. This is a workaround for an issue fixed in Terraform 0.12 but also provides a convenient way to access an IP of a specific type without performing filtering in a Terraform config.
+         */
         privateIpAddress: string;
         /**
          * The ID of the project in which the resources belong. If it is not provided, the provider project is used.
@@ -125653,6 +127526,9 @@ export declare namespace sql {
          * The link to service attachment of PSC instance.
          */
         pscServiceAttachmentLink: string;
+        /**
+         * IPv4 address assigned. This is a workaround for an issue fixed in Terraform 0.12 but also provides a convenient way to access an IP of a specific type without performing filtering in a Terraform config.
+         */
         publicIpAddress: string;
         /**
          * To filter out the Cloud SQL instances which are located in the specified region.
@@ -126673,12 +128549,11 @@ export declare namespace storage {
          */
         customTimeBefore?: string;
         /**
-         * Number of days elapsed since the user-specified timestamp set on an object.
+         * Days since the date set in the `customTime` metadata for the object. This condition is satisfied when the current date and time is at least the specified number of days after the `customTime`. Due to a current bug you are unable to set this value to `0` within Terraform. When set to `0` it will be ignored, and your state will treat it as though you supplied no `daysSinceCustomTime` condition.
          */
         daysSinceCustomTime?: number;
         /**
-         * Number of days elapsed since the noncurrent timestamp of an object. This
-         * 										condition is relevant only for versioned objects.
+         * Relevant only for versioned objects. Number of days elapsed since the noncurrent timestamp of an object. Due to a current bug you are unable to set this value to `0` within Terraform. When set to `0` it will be ignored, and your state will treat it as though you supplied no `daysSinceNoncurrentTime` condition.
          */
         daysSinceNoncurrentTime?: number;
         /**
@@ -126694,11 +128569,11 @@ export declare namespace storage {
          */
         matchesSuffixes?: string[];
         /**
-         * Creation date of an object in RFC 3339 (e.g. 2017-06-13) to satisfy this condition.
+         * Relevant only for versioned objects. The date in RFC 3339 (e.g. `2017-06-13`) when the object became nonconcurrent. Due to a current bug you are unable to set this value to `0` within Terraform. When set to `0` it will be ignored, and your state will treat it as though you supplied no `noncurrentTimeBefore` condition.
          */
         noncurrentTimeBefore?: string;
         /**
-         * Relevant only for versioned objects. The number of newer versions of an object to satisfy this condition.
+         * Relevant only for versioned objects. The number of newer versions of an object to satisfy this condition. Due to a current bug you are unable to set this value to `0` within Terraform. When set to `0` it will be ignored and your state will treat it as though you supplied no `numNewerVersions` condition.
          */
         numNewerVersions?: number;
         /**
@@ -127246,6 +129121,41 @@ export declare namespace storage {
          */
         retainUntilTime: string;
     }
+    interface GetBucketObjectContentsBucketObject {
+        /**
+         * The content of the object.
+         */
+        content: string;
+        /**
+         * Base64 encoded version of the object content.
+         * Use this when dealing with binary data.
+         */
+        contentBase64: string;
+        /**
+         * Base64 encoded SHA512 checksum of file content.
+         */
+        contentBase64sha512: string;
+        /**
+         * Hex encoded SHA512 checksum of file content.
+         */
+        contentHexsha512: string;
+        /**
+         * [Content-Type](https://tools.ietf.org/html/rfc7231#section-3.1.1.5) of the object data.
+         */
+        contentType: string;
+        /**
+         * A url reference to download this object.
+         */
+        mediaLink: string;
+        /**
+         * The name of the object.
+         */
+        name: string;
+        /**
+         * A url reference to this object.
+         */
+        selfLink: string;
+    }
     interface GetBucketObjectContext {
         /**
          * A list of custom context key-value pairs.
@@ -127810,6 +129720,13 @@ export declare namespace storage {
     interface InsightsReportConfigParquetOptions {
     }
     interface ManagedFolderIamBindingCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -127821,6 +129738,13 @@ export declare namespace storage {
         title: string;
     }
     interface ManagedFolderIamMemberCondition {
+        /**
+         * An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+         *
+         * > **Warning:** Terraform considers the `role` and condition contents (`title`+`description`+`expression`) as the
+         * identifier for the binding. This means that if any part of the condition is changed out-of-band, Terraform will
+         * consider it to be an entirely different resource and will treat it as such.
+         */
         description?: string;
         /**
          * Textual representation of an expression in Common Expression Language syntax.
@@ -129472,6 +131396,63 @@ export declare namespace transcoder {
         topic?: string;
     }
 }
+export declare namespace vectorsearch {
+    interface CollectionVectorSchema {
+        /**
+         * Message describing a dense vector field.
+         * Structure is documented below.
+         */
+        denseVector?: outputs.vectorsearch.CollectionVectorSchemaDenseVector;
+        /**
+         * The identifier for this object. Format specified above.
+         */
+        fieldName: string;
+        /**
+         * Message describing a sparse vector field.
+         */
+        sparseVector?: outputs.vectorsearch.CollectionVectorSchemaSparseVector;
+    }
+    interface CollectionVectorSchemaDenseVector {
+        /**
+         * Dimensionality of the vector field.
+         */
+        dimensions?: number;
+        /**
+         * Message describing the configuration for generating embeddings for a vector
+         * field using Vertex AI embeddings API.
+         * Structure is documented below.
+         */
+        vertexEmbeddingConfig?: outputs.vectorsearch.CollectionVectorSchemaDenseVectorVertexEmbeddingConfig;
+    }
+    interface CollectionVectorSchemaDenseVectorVertexEmbeddingConfig {
+        /**
+         * Required: ID of the embedding model to use. See
+         * https://cloud.google.com/vertex-ai/generative-ai/docs/learn/models#embeddings-models
+         * for the list of supported models.
+         */
+        modelId: string;
+        /**
+         * Possible values:
+         * RETRIEVAL_QUERY
+         * RETRIEVAL_DOCUMENT
+         * SEMANTIC_SIMILARITY
+         * CLASSIFICATION
+         * CLUSTERING
+         * QUESTION_ANSWERING
+         * FACT_VERIFICATION
+         * CODE_RETRIEVAL_QUERY
+         */
+        taskType: string;
+        /**
+         * Required: Text template for the input to the model. The template must
+         * contain one or more references to fields in the DataObject, e.g.:
+         * "Movie Title: {title} ---- Movie Plot: {plot}".
+         */
+        textTemplate: string;
+    }
+    interface CollectionVectorSchemaSparseVector {
+    }
+}
 export declare namespace vertex {
     interface AiDatasetEncryptionSpec {
         /**
@@ -131472,6 +133453,11 @@ export declare namespace vertex {
         requirementsGcsUri?: string;
     }
     interface AiReasoningEngineSpecSourceCodeSpec {
+        /**
+         * Specification for source code to be fetched from a Git repository managed through the Developer Connect service.
+         * Structure is documented below.
+         */
+        developerConnectSource?: outputs.vertex.AiReasoningEngineSpecSourceCodeSpecDeveloperConnectSource;
         /**
          * Source code is provided directly in the request.
          * Structure is documented below.
@@ -131483,6 +133469,27 @@ export declare namespace vertex {
          */
         pythonSpec?: outputs.vertex.AiReasoningEngineSpecSourceCodeSpecPythonSpec;
     }
+    interface AiReasoningEngineSpecSourceCodeSpecDeveloperConnectSource {
+        /**
+         * The Developer Connect configuration that defines the specific repository, revision, and directory to use as the source code root.
+         * Structure is documented below.
+         */
+        config: outputs.vertex.AiReasoningEngineSpecSourceCodeSpecDeveloperConnectSourceConfig;
+    }
+    interface AiReasoningEngineSpecSourceCodeSpecDeveloperConnectSourceConfig {
+        /**
+         * Directory, relative to the source root, in which to run the build.
+         */
+        dir: string;
+        /**
+         * The Developer Connect Git repository link, formatted as projects/*&#47;locations/*&#47;connections/*&#47;gitRepositoryLink/*.
+         */
+        gitRepositoryLink: string;
+        /**
+         * The revision to fetch from the Git repository such as a branch, a tag, a commit SHA, or any Git ref.
+         */
+        revision: string;
+    }
     interface AiReasoningEngineSpecSourceCodeSpecInlineSource {
         /**
          * Required. Input only.
@@ -131731,6 +133738,88 @@ export declare namespace vmwareengine {
          */
         scaleOut: number;
     }
+    interface ClusterDatastoreMountConfig {
+        /**
+         * Optional. NFS is accessed by hosts in either read or readWrite mode
+         * Default value used will be READ_WRITE
+         * Possible values:
+         * READ_ONLY
+         * READ_WRITE
+         */
+        accessMode?: string;
+        /**
+         * The resource name of the datastore to unmount.
+         * The datastore requested to be mounted should be in same region/zone as the
+         * cluster.
+         * Resource names are schemeless URIs that follow the conventions in
+         * https://cloud.google.com/apis/design/resource_names.
+         * For example:
+         * `projects/my-project/locations/us-central1/datastores/my-datastore`
+         */
+        datastore: string;
+        /**
+         * The network configuration for the datastore.
+         * Structure is documented below.
+         */
+        datastoreNetwork: outputs.vmwareengine.ClusterDatastoreMountConfigDatastoreNetwork;
+        /**
+         * (Output)
+         * File share name.
+         */
+        fileShare: string;
+        /**
+         * Optional. If set to true, the colocation requirement will be ignored.
+         * If set to false, the colocation requirement will be enforced.
+         * Colocation requirement is the requirement that the cluster must be in the
+         * same region/zone of datastore.
+         */
+        ignoreColocation?: boolean;
+        /**
+         * Optional. The NFS protocol supported by the NFS volume.
+         * Default value used will be NFS_V3
+         * Possible values:
+         * NFS_V3
+         */
+        nfsVersion?: string;
+        /**
+         * (Output)
+         * Server IP addresses of the NFS volume.
+         * For NFS 3, you can only provide a single
+         * server IP address or DNS names.
+         */
+        servers: string[];
+    }
+    interface ClusterDatastoreMountConfigDatastoreNetwork {
+        /**
+         * Optional. The number of connections of the NFS volume.
+         * Supported from vsphere 8.0u1. Possible values are 1-4.
+         * Default value is 4.
+         */
+        connectionCount?: number;
+        /**
+         * Optional. The Maximal Transmission Unit (MTU) of the datastore.
+         * MTU value can range from 1330-9000. If not set, system sets
+         * default MTU size to 1500.
+         */
+        mtu?: number;
+        /**
+         * (Output)
+         * The resource name of the network peering, used to access the
+         * file share by clients on private cloud. Resource names are schemeless
+         * URIs that follow the conventions in
+         * https://cloud.google.com/apis/design/resource_names.
+         * e.g.
+         * projects/my-project/locations/us-central1/networkPeerings/my-network-peering
+         */
+        networkPeering: string;
+        /**
+         * The resource name of the subnet
+         * Resource names are schemeless URIs that follow the conventions in
+         * https://cloud.google.com/apis/design/resource_names.
+         * e.g. projects/my-project/locations/us-central1/subnets/my-subnet
+         */
+        subnet: string;
+    }
     interface ClusterNodeTypeConfig {
         /**
          * Customized number of cores available to each node of the type.
@@ -131900,6 +133989,84 @@ export declare namespace vmwareengine {
          */
         scaleOut: number;
     }
+    interface GetClusterDatastoreMountConfig {
+        /**
+         * Optional. NFS is accessed by hosts in either read or readWrite mode
+         * Default value used will be READ_WRITE
+         * Possible values:
+         * READ_ONLY
+         * READ_WRITE
+         */
+        accessMode: string;
+        /**
+         * The resource name of the datastore to unmount.
+         * The datastore requested to be mounted should be in same region/zone as the
+         * cluster.
+         * Resource names are schemeless URIs that follow the conventions in
+         * https://cloud.google.com/apis/design/resource_names.
+         * For example:
+         * 'projects/my-project/locations/us-central1/datastores/my-datastore'
+         */
+        datastore: string;
+        /**
+         * The network configuration for the datastore.
+         */
+        datastoreNetworks: outputs.vmwareengine.GetClusterDatastoreMountConfigDatastoreNetwork[];
+        /**
+         * File share name.
+         */
+        fileShare: string;
+        /**
+         * Optional. If set to true, the colocation requirement will be ignored.
+         * If set to false, the colocation requirement will be enforced.
+         * Colocation requirement is the requirement that the cluster must be in the
+         * same region/zone of datastore.
+         */
+        ignoreColocation: boolean;
+        /**
+         * Optional. The NFS protocol supported by the NFS volume.
+         * Default value used will be NFS_V3
+         * Possible values:
+         * NFS_V3
+         */
+        nfsVersion: string;
+        /**
+         * Server IP addresses of the NFS volume.
+         * For NFS 3, you can only provide a single
+         * server IP address or DNS names.
+         */
+        servers: string[];
+    }
+    interface GetClusterDatastoreMountConfigDatastoreNetwork {
+        /**
+         * Optional. The number of connections of the NFS volume.
+         * Supported from vsphere 8.0u1. Possible values are 1-4.
+         * Default value is 4.
+         */
+        connectionCount: number;
+        /**
+         * Optional. The Maximal Transmission Unit (MTU) of the datastore.
+         * MTU value can range from 1330-9000. If not set, system sets
+         * default MTU size to 1500.
+         */
+        mtu: number;
+        /**
+         * The resource name of the network peering, used to access the
+         * file share by clients on private cloud. Resource names are schemeless
+         * URIs that follow the conventions in
+         * https://cloud.google.com/apis/design/resource_names.
+         * e.g.
+         * projects/my-project/locations/us-central1/networkPeerings/my-network-peering
+         */
+        networkPeering: string;
+        /**
+         * The resource name of the subnet
+         * Resource names are schemeless URIs that follow the conventions in
+         * https://cloud.google.com/apis/design/resource_names.
+         * e.g. projects/my-project/locations/us-central1/subnets/my-subnet
+         */
+        subnet: string;
+    }
     interface GetClusterNodeTypeConfig {
         /**
          * Customized number of cores available to each node of the type.