google-api-python-client 2.188.0__py3-none-any.whl → 2.190.0__py3-none-any.whl

googleapiclient/discovery_cache/documents/gkehub.v1beta.json

@@ -183,7 +183,7 @@
 ]
 },
 "list": {
-"description": "Lists information about the supported locations for this service.",
+"description": "Lists information about the supported locations for this service. This method can be called in two ways: * **List all public locations:** Use the path `GET /v1/locations`. * **List project-visible locations:** Use the path `GET /v1/projects/{project_id}/locations`. This may include public locations as well as private or other locations specifically visible to the project.",
 "flatPath": "v1beta/projects/{projectsId}/locations",
 "httpMethod": "GET",
 "id": "gkehub.projects.locations.list",
@@ -2354,7 +2354,7 @@
 }
 }
 },
-"revision": "20251201",
+"revision": "20260126",
 "rootUrl": "https://gkehub.googleapis.com/",
 "schemas": {
 "AppDevExperienceFeatureSpec": {
@@ -2530,7 +2530,7 @@
 "id": "ClusterSelector",
 "properties": {
 "labelSelector": {
-"description": "The label selector must be a valid CEL (go/cel) expression which evaluates resource.labels.",
+"description": "Required. A valid CEL (Common Expression Language) expression which evaluates `resource.labels`.",
 "type": "string"
 }
 },
@@ -2810,6 +2810,10 @@
 "rbacrolebindingactuation": {
 "$ref": "RBACRoleBindingActuationFeatureSpec",
 "description": "RBAC Role Binding Actuation feature spec"
+},
+"workloadidentity": {
+"$ref": "WorkloadIdentityFeatureSpec",
+"description": "Workload Identity feature spec."
 }
 },
 "type": "object"
@@ -2838,6 +2842,10 @@
 "$ref": "FeatureState",
 "description": "Output only. The \"running state\" of the Feature in this Fleet.",
 "readOnly": true
+},
+"workloadidentity": {
+"$ref": "WorkloadIdentityFeatureState",
+"description": "WorkloadIdentity fleet-level state."
 }
 },
 "type": "object"
@@ -2959,14 +2967,14 @@
 "id": "ConfigManagementConfigSync",
 "properties": {
 "deploymentOverrides": {
-"description": "Optional. Configuration for deployment overrides.",
+"description": "Optional. Configuration for deployment overrides. Applies only to Config Sync deployments with containers that are not a root or namespace reconciler: `reconciler-manager`, `otel-collector`, `resource-group-controller-manager`, `admission-webhook`. To override a root or namespace reconciler, use the rootsync or reposync fields at https://docs.cloud.google.com/kubernetes-engine/config-sync/docs/reference/rootsync-reposync-fields#override-resources instead.",
 "items": {
 "$ref": "ConfigManagementDeploymentOverride"
 },
 "type": "array"
 },
 "enabled": {
-"description": "Optional. Enables the installation of ConfigSync. If set to true, ConfigSync resources will be created and the other ConfigSync fields will be applied if exist. If set to false, all other ConfigSync fields will be ignored, ConfigSync resources will be deleted. If omitted, ConfigSync resources will be managed depends on the presence of the git or oci field.",
+"description": "Optional. Enables the installation of Config Sync. If set to true, the Feature will manage Config Sync resources, and apply the other ConfigSync fields if they exist. If set to false, the Feature will ignore all other ConfigSync fields and delete the Config Sync resources. If omitted, ConfigSync is considered enabled if the git or oci field is present.",
 "type": "boolean"
 },
 "git": {
@@ -2983,11 +2991,11 @@
 "description": "Optional. OCI repo configuration for the cluster"
 },
 "preventDrift": {
-"description": "Optional. Set to true to enable the Config Sync admission webhook to prevent drifts. If set to `false`, disables the Config Sync admission webhook and does not prevent drifts.",
+"description": "Optional. Set to true to enable the Config Sync admission webhook to prevent drifts. If set to false, disables the Config Sync admission webhook and does not prevent drifts. Defaults to false. See https://docs.cloud.google.com/kubernetes-engine/config-sync/docs/how-to/prevent-config-drift for details.",
 "type": "boolean"
 },
 "sourceFormat": {
-"description": "Optional. Specifies whether the Config Sync Repo is in \"hierarchical\" or \"unstructured\" mode.",
+"description": "Optional. Specifies whether the Config Sync repo is in `hierarchical` or `unstructured` mode. Defaults to `hierarchical`. See https://docs.cloud.google.com/kubernetes-engine/config-sync/docs/concepts/configs#organize-configs for an explanation.",
 "type": "string"
 },
 "stopSyncing": {
@@ -3339,19 +3347,19 @@
 "type": "string"
 },
 "cpuLimit": {
-"description": "Optional. The cpu limit of the container.",
+"description": "Optional. The cpu limit of the container. Use the following CPU resource units: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#meaning-of-cpu.",
 "type": "string"
 },
 "cpuRequest": {
-"description": "Optional. The cpu request of the container.",
+"description": "Optional. The cpu request of the container. Use the following CPU resource units: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#meaning-of-cpu.",
 "type": "string"
 },
 "memoryLimit": {
-"description": "Optional. The memory limit of the container.",
+"description": "Optional. The memory limit of the container. Use the following memory resource units: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#meaning-of-memory.",
 "type": "string"
 },
 "memoryRequest": {
-"description": "Optional. The memory request of the container.",
+"description": "Optional. The memory request of the container. Use the following memory resource units: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#meaning-of-memory.",
 "type": "string"
 }
 },
@@ -3468,11 +3476,11 @@
 "id": "ConfigManagementGitConfig",
 "properties": {
 "gcpServiceAccountEmail": {
-"description": "Optional. The Google Cloud Service Account Email used for auth when secret_type is gcpServiceAccount.",
+"description": "Optional. The Google Cloud Service Account Email used for auth when secret_type is `gcpserviceaccount`.",
 "type": "string"
 },
 "httpsProxy": {
-"description": "Optional. URL for the HTTPS proxy to be used when communicating with the Git repo.",
+"description": "Optional. URL for the HTTPS proxy to be used when communicating with the Git repo. Only specify when secret_type is `cookiefile`, `token`, or `none`.",
 "type": "string"
 },
 "policyDir": {
@@ -3480,7 +3488,7 @@
 "type": "string"
 },
 "secretType": {
-"description": "Required. Type of secret configured for access to the Git repo. Must be one of ssh, cookiefile, gcenode, token, gcpserviceaccount, githubapp or none. The validation of this is case-sensitive.",
+"description": "Required. Type of secret configured for access to the Git repo. Must be one of `ssh`, `cookiefile`, `gcenode`, `token`, `gcpserviceaccount`, `githubapp` or `none`. The validation of this is case-sensitive.",
 "type": "string"
 },
 "syncBranch": {
@@ -3632,10 +3640,10 @@
 "binauthz": {
 "$ref": "ConfigManagementBinauthzConfig",
 "deprecated": true,
-"description": "Optional. Binauthz conifguration for the cluster. Deprecated: This field will be ignored and should not be set."
+"description": "Optional. Deprecated: Binauthz configuration will be ignored and should not be set."
 },
 "cluster": {
-"description": "Optional. The user-specified cluster name used by Config Sync cluster-name-selector annotation or ClusterSelector, for applying configs to only a subset of clusters. Omit this field if the cluster's fleet membership name is used by Config Sync cluster-name-selector annotation or ClusterSelector. Set this field if a name different from the cluster's fleet membership name is used by Config Sync cluster-name-selector annotation or ClusterSelector.",
+"description": "Optional. User-specified cluster name used by the Config Sync cluster-name-selector annotation or ClusterSelector object, for applying configs to only a subset of clusters. Read more about the cluster-name-selector annotation and ClusterSelector object at https://docs.cloud.google.com/kubernetes-engine/config-sync/docs/how-to/cluster-scoped-objects#limiting-configs. Only set this field if a name different from the cluster's fleet membership name is used by the Config Sync cluster-name-selector annotation or ClusterSelector.",
 "type": "string"
 },
 "configSync": {
@@ -3648,7 +3656,8 @@
 "description": "Optional. Hierarchy Controller configuration for the cluster. Deprecated: Configuring Hierarchy Controller through the configmanagement feature is no longer recommended. Use https://github.com/kubernetes-sigs/hierarchical-namespaces instead."
 },
 "management": {
-"description": "Optional. Enables automatic Feature management.",
+"deprecated": true,
+"description": "Optional. Deprecated: From version 1.21.0, automatic Feature management is unavailable, and Config Sync only supports manual upgrades.",
 "enum": [
 "MANAGEMENT_UNSPECIFIED",
 "MANAGEMENT_AUTOMATIC",
@@ -3667,7 +3676,7 @@
 "description": "Optional. Policy Controller configuration for the cluster. Deprecated: Configuring Policy Controller through the configmanagement feature is no longer recommended. Use the policycontroller feature instead."
 },
 "version": {
-"description": "Optional. Version of ACM installed.",
+"description": "Optional. Version of Config Sync to install. Defaults to the latest supported Config Sync version if the config_sync field is enabled. See supported versions at https://cloud.google.com/kubernetes-engine/config-sync/docs/get-support-config-sync#version_support_policy.",
 "type": "string"
 }
 },
@@ -3725,7 +3734,7 @@
 "id": "ConfigManagementOciConfig",
 "properties": {
 "gcpServiceAccountEmail": {
-"description": "Optional. The Google Cloud Service Account Email used for auth when secret_type is gcpServiceAccount.",
+"description": "Optional. The Google Cloud Service Account Email used for auth when secret_type is `gcpserviceaccount`.",
 "type": "string"
 },
 "policyDir": {
@@ -3733,7 +3742,7 @@
 "type": "string"
 },
 "secretType": {
-"description": "Required. Type of secret configured for access to the OCI repo. Must be one of gcenode, gcpserviceaccount, k8sserviceaccount or none. The validation of this is case-sensitive.",
+"description": "Required. Type of secret configured for access to the OCI repo. Must be one of `gcenode`, `gcpserviceaccount`, `k8sserviceaccount` or `none`. The validation of this is case-sensitive.",
 "type": "string"
 },
 "syncRepo": {
@@ -5647,6 +5656,10 @@
 "state": {
 "$ref": "FeatureState",
 "description": "The high-level state of this Feature for a single membership."
+},
+"workloadidentity": {
+"$ref": "WorkloadIdentityMembershipState",
+"description": "Workload Identity membership specific state."
 }
 },
 "type": "object"
@@ -6654,7 +6667,7 @@
 "type": "string"
 },
 "rolloutSequence": {
-"description": "Optional. Immutable. The full, unique resource name of the rollout sequence that initiatied this Rollout. In the format of `projects/{project}/locations/global/rolloutSequences/{rollout_sequence}`. Empty for user initiated rollouts.",
+"description": "Optional. Immutable. The full, unique resource name of the rollout sequence that initiatied this Rollout. In the format of `projects/{project}/locations/global/rolloutSequences/{rollout_sequence}`.",
 "type": "string"
 },
 "schedule": {
@@ -6663,7 +6676,7 @@
 "readOnly": true
 },
 "stages": {
-"description": "Output only. The stages of the Rollout. Note: this is only populated for google-initiated rollouts.",
+"description": "Output only. The stages of the Rollout.",
 "items": {
 "$ref": "RolloutStage"
 },
@@ -6709,7 +6722,7 @@
 },
 "versionUpgrade": {
 "$ref": "VersionUpgrade",
-"description": "Optional. Config for version upgrade of clusters. Note: Currently for GDCE clusters only."
+"description": "Optional. Config for version upgrade of clusters."
 }
 },
 "type": "object"
@@ -6854,12 +6867,12 @@
 "id": "RolloutTarget",
 "properties": {
 "cluster": {
-"description": "Optional. Output only. The resource link of the Cluster resource upgraded in this Rollout. It is formatted as: ///projects//locations//clusters/. I.e. for GKE clusters, it is formatted as: //container.googleapis.com/projects//locations//clusters/. For GDCE, it is formatted as: //edgecontainer.googleapis.com/projects//locations//clusters/.",
+"description": "Optional. Output only. The resource link of the Cluster resource upgraded in this Rollout. It is formatted as: `//{api_service}/projects/{project_number}/locations/{location}/clusters/{cluster_name}`. .",
 "readOnly": true,
 "type": "string"
 },
 "nodePool": {
-"description": "Optional. Output only. The resource link of the NodePool resource upgraded in this Rollout. It is formatted as: ///projects//locations//clusters//nodePools/.",
+"description": "Optional. Output only. The resource link of the NodePool resource upgraded in this Rollout. It is formatted as: `//{api_service}/projects/{project_number}/locations/{location}/clusters/{cluster_name}/nodePools/{node_pool_name}`.",
 "readOnly": true,
 "type": "string"
 },
@@ -7546,6 +7559,156 @@
 }
 },
 "type": "object"
+},
+"WorkloadIdentityFeatureSpec": {
+"description": "**WorkloadIdentity**: Global feature specification.",
+"id": "WorkloadIdentityFeatureSpec",
+"properties": {
+"scopeTenancyPool": {
+"description": "Pool to be used for Workload Identity. This pool in trust-domain mode is used with Fleet Tenancy, so that sameness can be enforced. ex: projects/example/locations/global/workloadidentitypools/custompool",
+"type": "string"
+}
+},
+"type": "object"
+},
+"WorkloadIdentityFeatureState": {
+"description": "**WorkloadIdentity**: Global feature state.",
+"id": "WorkloadIdentityFeatureState",
+"properties": {
+"namespaceStateDetails": {
+"additionalProperties": {
+"$ref": "WorkloadIdentityNamespaceStateDetail"
+},
+"description": "The state of the IAM namespaces for the fleet.",
+"type": "object"
+},
+"namespaceStates": {
+"additionalProperties": {
+"enum": [
+"NAMESPACE_STATE_UNSPECIFIED",
+"NAMESPACE_STATE_OK",
+"NAMESPACE_STATE_ERROR"
+],
+"enumDescriptions": [
+"Unknown state.",
+"The Namespace was created/updated successfully.",
+"The Namespace was not created/updated successfully. The error message is in the description field."
+],
+"type": "string"
+},
+"description": "Deprecated, this field will be erased after code is changed to use the new field.",
+"type": "object"
+},
+"scopeTenancyWorkloadIdentityPool": {
+"description": "The full name of the scope-tenancy pool for the fleet.",
+"type": "string"
+},
+"workloadIdentityPool": {
+"description": "The full name of the svc.id.goog pool for the fleet.",
+"type": "string"
+},
+"workloadIdentityPoolStateDetails": {
+"additionalProperties": {
+"$ref": "WorkloadIdentityWorkloadIdentityPoolStateDetail"
+},
+"description": "The state of the Workload Identity Pools for the fleet.",
+"type": "object"
+}
+},
+"type": "object"
+},
+"WorkloadIdentityIdentityProviderStateDetail": {
+"description": "IdentityProviderStateDetail represents the state of an Identity Provider.",
+"id": "WorkloadIdentityIdentityProviderStateDetail",
+"properties": {
+"code": {
+"description": "The state of the Identity Provider.",
+"enum": [
+"IDENTITY_PROVIDER_STATE_UNSPECIFIED",
+"IDENTITY_PROVIDER_STATE_OK",
+"IDENTITY_PROVIDER_STATE_ERROR"
+],
+"enumDescriptions": [
+"Unknown state.",
+"The Identity Provider was created/updated successfully.",
+"The Identity Provider was not created/updated successfully. The error message is in the description field."
+],
+"type": "string"
+},
+"description": {
+"description": "A human-readable description of the current state or returned error.",
+"type": "string"
+}
+},
+"type": "object"
+},
+"WorkloadIdentityMembershipState": {
+"description": "**WorkloadIdentity**: The membership-specific state for WorkloadIdentity feature.",
+"id": "WorkloadIdentityMembershipState",
+"properties": {
+"description": {
+"description": "Deprecated, this field will be erased after code is changed to use the new field.",
+"type": "string"
+},
+"identityProviderStateDetails": {
+"additionalProperties": {
+"$ref": "WorkloadIdentityIdentityProviderStateDetail"
+},
+"description": "The state of the Identity Providers corresponding to the membership.",
+"type": "object"
+}
+},
+"type": "object"
+},
+"WorkloadIdentityNamespaceStateDetail": {
+"description": "NamespaceStateDetail represents the state of a IAM namespace.",
+"id": "WorkloadIdentityNamespaceStateDetail",
+"properties": {
+"code": {
+"description": "The state of the IAM namespace.",
+"enum": [
+"NAMESPACE_STATE_UNSPECIFIED",
+"NAMESPACE_STATE_OK",
+"NAMESPACE_STATE_ERROR"
+],
+"enumDescriptions": [
+"Unknown state.",
+"The Namespace was created/updated successfully.",
+"The Namespace was not created/updated successfully. The error message is in the description field."
+],
+"type": "string"
+},
+"description": {
+"description": "A human-readable description of the current state or returned error.",
+"type": "string"
+}
+},
+"type": "object"
+},
+"WorkloadIdentityWorkloadIdentityPoolStateDetail": {
+"description": "WorkloadIdentityPoolStateDetail represents the state of the Workload Identity Pools for the fleet.",
+"id": "WorkloadIdentityWorkloadIdentityPoolStateDetail",
+"properties": {
+"code": {
+"description": "The state of the Workload Identity Pool.",
+"enum": [
+"WORKLOAD_IDENTITY_POOL_STATE_UNSPECIFIED",
+"WORKLOAD_IDENTITY_POOL_STATE_OK",
+"WORKLOAD_IDENTITY_POOL_STATE_ERROR"
+],
+"enumDescriptions": [
+"Unknown state.",
+"The Workload Identity Pool was created/updated successfully.",
+"The Workload Identity Pool was not created/updated successfully. The error message is in the description field."
+],
+"type": "string"
+},
+"description": {
+"description": "A human-readable description of the current state or returned error.",
+"type": "string"
+}
+},
+"type": "object"
 }
 },
 "servicePath": "",

googleapiclient/discovery_cache/documents/gkehub.v1beta1.json

@@ -135,7 +135,7 @@
 ]
 },
 "list": {
-"description": "Lists information about the supported locations for this service.",
+"description": "Lists information about the supported locations for this service. This method can be called in two ways: * **List all public locations:** Use the path `GET /v1/locations`. * **List project-visible locations:** Use the path `GET /v1/projects/{project_id}/locations`. This may include public locations as well as private or other locations specifically visible to the project.",
 "flatPath": "v1beta1/projects/{projectsId}/locations",
 "httpMethod": "GET",
 "id": "gkehub.projects.locations.list",
@@ -723,7 +723,7 @@
 }
 }
 },
-"revision": "20251201",
+"revision": "20260126",
 "rootUrl": "https://gkehub.googleapis.com/",
 "schemas": {
 "ApplianceCluster": {

googleapiclient/discovery_cache/documents/gkehub.v2.json

@@ -135,7 +135,7 @@
 ]
 },
 "list": {
-"description": "Lists information about the supported locations for this service.",
+"description": "Lists information about the supported locations for this service. This method can be called in two ways: * **List all public locations:** Use the path `GET /v1/locations`. * **List project-visible locations:** Use the path `GET /v1/projects/{project_id}/locations`. This may include public locations as well as private or other locations specifically visible to the project.",
 "flatPath": "v2/projects/{projectsId}/locations",
 "httpMethod": "GET",
 "id": "gkehub.projects.locations.list",
@@ -482,7 +482,7 @@
 }
 }
 },
-"revision": "20251201",
+"revision": "20260126",
 "rootUrl": "https://gkehub.googleapis.com/",
 "schemas": {
 "AppDevExperienceState": {
@@ -712,14 +712,14 @@
 "id": "ConfigManagementConfigSync",
 "properties": {
 "deploymentOverrides": {
-"description": "Optional. Configuration for deployment overrides.",
+"description": "Optional. Configuration for deployment overrides. Applies only to Config Sync deployments with containers that are not a root or namespace reconciler: `reconciler-manager`, `otel-collector`, `resource-group-controller-manager`, `admission-webhook`. To override a root or namespace reconciler, use the rootsync or reposync fields at https://docs.cloud.google.com/kubernetes-engine/config-sync/docs/reference/rootsync-reposync-fields#override-resources instead.",
 "items": {
 "$ref": "ConfigManagementDeploymentOverride"
 },
 "type": "array"
 },
 "enabled": {
-"description": "Optional. Enables the installation of ConfigSync. If set to true, ConfigSync resources will be created and the other ConfigSync fields will be applied if exist. If set to false, all other ConfigSync fields will be ignored, ConfigSync resources will be deleted. If omitted, ConfigSync resources will be managed depends on the presence of the git or oci field.",
+"description": "Optional. Enables the installation of Config Sync. If set to true, the Feature will manage Config Sync resources, and apply the other ConfigSync fields if they exist. If set to false, the Feature will ignore all other ConfigSync fields and delete the Config Sync resources. If omitted, ConfigSync is considered enabled if the git or oci field is present.",
 "type": "boolean"
 },
 "git": {
@@ -736,11 +736,11 @@
 "description": "Optional. OCI repo configuration for the cluster."
 },
 "preventDrift": {
-"description": "Optional. Set to true to enable the Config Sync admission webhook to prevent drifts. If set to `false`, disables the Config Sync admission webhook and does not prevent drifts.",
+"description": "Optional. Set to true to enable the Config Sync admission webhook to prevent drifts. If set to false, disables the Config Sync admission webhook and does not prevent drifts. Defaults to false. See https://docs.cloud.google.com/kubernetes-engine/config-sync/docs/how-to/prevent-config-drift for details.",
 "type": "boolean"
 },
 "sourceFormat": {
-"description": "Optional. Specifies whether the Config Sync Repo is in \"hierarchical\" or \"unstructured\" mode.",
+"description": "Optional. Specifies whether the Config Sync repo is in `hierarchical` or `unstructured` mode. Defaults to `hierarchical`. See https://docs.cloud.google.com/kubernetes-engine/config-sync/docs/concepts/configs#organize-configs for an explanation.",
 "type": "string"
 },
 "stopSyncing": {
@@ -1092,19 +1092,19 @@
 "type": "string"
 },
 "cpuLimit": {
-"description": "Optional. The cpu limit of the container.",
+"description": "Optional. The cpu limit of the container. Use the following CPU resource units: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#meaning-of-cpu.",
 "type": "string"
 },
 "cpuRequest": {
-"description": "Optional. The cpu request of the container.",
+"description": "Optional. The cpu request of the container. Use the following CPU resource units: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#meaning-of-cpu.",
 "type": "string"
 },
 "memoryLimit": {
-"description": "Optional. The memory limit of the container.",
+"description": "Optional. The memory limit of the container. Use the following memory resource units: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#meaning-of-memory.",
 "type": "string"
 },
 "memoryRequest": {
-"description": "Optional. The memory request of the container.",
+"description": "Optional. The memory request of the container. Use the following memory resource units: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#meaning-of-memory.",
 "type": "string"
 }
 },
@@ -1221,11 +1221,11 @@
 "id": "ConfigManagementGitConfig",
 "properties": {
 "gcpServiceAccountEmail": {
-"description": "Optional. The Google Cloud Service Account Email used for auth when secret_type is gcpServiceAccount.",
+"description": "Optional. The Google Cloud Service Account Email used for auth when secret_type is `gcpserviceaccount`.",
 "type": "string"
 },
 "httpsProxy": {
-"description": "Optional. URL for the HTTPS proxy to be used when communicating with the Git repo.",
+"description": "Optional. URL for the HTTPS proxy to be used when communicating with the Git repo. Only specify when secret_type is `cookiefile`, `token`, or `none`.",
 "type": "string"
 },
 "policyDir": {
@@ -1233,7 +1233,7 @@
 "type": "string"
 },
 "secretType": {
-"description": "Required. Type of secret configured for access to the Git repo. Must be one of ssh, cookiefile, gcenode, token, gcpserviceaccount, githubapp or none. The validation of this is case-sensitive.",
+"description": "Required. Type of secret configured for access to the Git repo. Must be one of `ssh`, `cookiefile`, `gcenode`, `token`, `gcpserviceaccount`, `githubapp` or `none`. The validation of this is case-sensitive.",
 "type": "string"
 },
 "syncBranch": {
@@ -1383,7 +1383,7 @@
 "id": "ConfigManagementOciConfig",
 "properties": {
 "gcpServiceAccountEmail": {
-"description": "Optional. The Google Cloud Service Account Email used for auth when secret_type is gcpServiceAccount.",
+"description": "Optional. The Google Cloud Service Account Email used for auth when secret_type is `gcpserviceaccount`.",
 "type": "string"
 },
 "policyDir": {
@@ -1391,7 +1391,7 @@
 "type": "string"
 },
 "secretType": {
-"description": "Required. Type of secret configured for access to the OCI repo. Must be one of gcenode, gcpserviceaccount, k8sserviceaccount or none. The validation of this is case-sensitive.",
+"description": "Required. Type of secret configured for access to the OCI repo. Must be one of `gcenode`, `gcpserviceaccount`, `k8sserviceaccount` or `none`. The validation of this is case-sensitive.",
 "type": "string"
 },
 "syncRepo": {
@@ -1578,10 +1578,10 @@
 "binauthz": {
 "$ref": "ConfigManagementBinauthzConfig",
 "deprecated": true,
-"description": "Optional. Binauthz conifguration for the cluster. Deprecated: This field will be ignored and should not be set."
+"description": "Optional. Deprecated: Binauthz configuration will be ignored and should not be set."
 },
 "cluster": {
-"description": "Optional. The user-specified cluster name used by Config Sync cluster-name-selector annotation or ClusterSelector, for applying configs to only a subset of clusters. Omit this field if the cluster's fleet membership name is used by Config Sync cluster-name-selector annotation or ClusterSelector. Set this field if a name different from the cluster's fleet membership name is used by Config Sync cluster-name-selector annotation or ClusterSelector.",
+"description": "Optional. User-specified cluster name used by the Config Sync cluster-name-selector annotation or ClusterSelector object, for applying configs to only a subset of clusters. Read more about the cluster-name-selector annotation and ClusterSelector object at https://docs.cloud.google.com/kubernetes-engine/config-sync/docs/how-to/cluster-scoped-objects#limiting-configs. Only set this field if a name different from the cluster's fleet membership name is used by the Config Sync cluster-name-selector annotation or ClusterSelector.",
 "type": "string"
 },
 "configSync": {
@@ -1594,7 +1594,8 @@
 "description": "Optional. Hierarchy Controller configuration for the cluster. Deprecated: Configuring Hierarchy Controller through the configmanagement feature is no longer recommended. Use https://github.com/kubernetes-sigs/hierarchical-namespaces instead."
 },
 "management": {
-"description": "Optional. Enables automatic Feature management.",
+"deprecated": true,
+"description": "Optional. Deprecated: From version 1.21.0, automatic Feature management is unavailable, and Config Sync only supports manual upgrades.",
 "enum": [
 "MANAGEMENT_UNSPECIFIED",
 "MANAGEMENT_AUTOMATIC",
@@ -1613,7 +1614,7 @@
 "description": "Optional. Policy Controller configuration for the cluster. Deprecated: Configuring Policy Controller through the configmanagement feature is no longer recommended. Use the policycontroller feature instead."
 },
 "version": {
-"description": "Optional. Version of ACM installed.",
+"description": "Optional. Version of Config Sync to install. Defaults to the latest supported Config Sync version if the config_sync field is enabled. See supported versions at https://cloud.google.com/kubernetes-engine/config-sync/docs/get-support-config-sync#version_support_policy.",
 "type": "string"
 }
 },
@@ -1832,6 +1833,10 @@
 "state": {
 "$ref": "State",
 "description": "The high-level state of this MembershipFeature."
+},
+"workloadidentity": {
+"$ref": "WorkloadIdentityState",
+"description": "Workload Identity state"
 }
 },
 "type": "object"
@@ -3462,6 +3467,49 @@
 }
 },
 "type": "object"
+},
+"WorkloadIdentityIdentityProviderStateDetail": {
+"description": "IdentityProviderStateDetail represents the state of an Identity Provider.",
+"id": "WorkloadIdentityIdentityProviderStateDetail",
+"properties": {
+"code": {
+"description": "The state of the Identity Provider.",
+"enum": [
+"IDENTITY_PROVIDER_STATE_UNSPECIFIED",
+"IDENTITY_PROVIDER_STATE_OK",
+"IDENTITY_PROVIDER_STATE_ERROR"
+],
+"enumDescriptions": [
+"Unknown state.",
+"The Identity Provider was created/updated successfully.",
+"The Identity Provider was not created/updated successfully. The error message is in the description field."
+],
+"type": "string"
+},
+"description": {
+"description": "A human-readable description of the current state or returned error.",
+"type": "string"
+}
+},
+"type": "object"
+},
+"WorkloadIdentityState": {
+"description": "**WorkloadIdentity**: The membership-specific state for WorkloadIdentity feature.",
+"id": "WorkloadIdentityState",
+"properties": {
+"description": {
+"description": "Deprecated, this field will be erased after code is changed to use the new field.",
+"type": "string"
+},
+"identityProviderStateDetails": {
+"additionalProperties": {
+"$ref": "WorkloadIdentityIdentityProviderStateDetail"
+},
+"description": "The state of the Identity Providers corresponding to the membership.",
+"type": "object"
+}
+},
+"type": "object"
 }
 },
 "servicePath": "",