feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/surface/compute/networks/subnets/__init__.py

@@ -0,0 +1,36 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2015 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Commands for reading and manipulating subnetworks."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+class Subnetworks(base.Group):
+  """List, describe, and delete, and update Compute Engine subnetworks."""
+
+Subnetworks.detailed_help = {
+    'DESCRIPTION': """
+        Read and manipulate VPC subnetworks.
+
+        For more information about VPC, see the
+        [VPC documentation](https://cloud.google.com/vpc/docs/vpc).
+
+        See also: [Subnetworks API](https://cloud.google.com/compute/docs/reference/rest/v1/subnetworks).
+    """,
+}

gcloud auth application-default login/google-cloud-sdk/lib/surface/compute/networks/subnets/add_iam_policy_binding.yaml

@@ -0,0 +1,62 @@
+release_tracks: [GA, BETA, ALPHA]
+help_text:
+  brief: Add an IAM policy binding to a Compute Engine subnetwork.
+  description: |
+    Add an IAM policy binding to a Compute Engine subnetwork.
+
+  examples: |
+    To add an IAM policy binding for the role of 'roles/compute.securityAdmin' for the user 'test-user@gmail.com'
+    with subnetwork 'my-subnet' and region 'REGION', run:
+
+      $ {command} my-subnet --region=REGION --member='user:test-user@gmail.com' --role='roles/compute.securityAdmin'
+
+    See https://cloud.google.com/iam/docs/managing-policies for details of
+    policy role and member types.
+
+request:
+  collection: compute.subnetworks
+  use_relative_name: false
+  api_version: v1
+  BETA:
+    api_version: beta
+  ALPHA:
+    api_version: alpha
+
+iam:
+  set_iam_policy_request_path: regionSetPolicyRequest
+  message_type_overrides:
+    policy: Policy
+    set_iam_policy_request: ComputeSubnetworksSetIamPolicyRequest
+  ALPHA:
+    enable_condition: true
+    policy_version: 3
+    get_iam_policy_version_path: optionsRequestedPolicyVersion
+  BETA:
+    policy_version: 3
+    get_iam_policy_version_path: optionsRequestedPolicyVersion
+
+arguments:
+  resource:
+    help_text: The subnetwork for which to add the IAM policy to.
+    spec: !REF googlecloudsdk.command_lib.compute.resources:subnet
+
+ALPHA:
+  help_text:
+    brief: Add IAM policy binding to a Compute Engine subnetwork.
+    description: |
+      Add an IAM policy binding to the IAM policy of a Compute Engine subnetwork. One binding consists of a member,
+      a role, and an optional condition.
+
+    examples: |
+      To add an IAM policy binding for the role of 'roles/compute.securityAdmin' for the user 'test-user@gmail.com'
+      with subnetwork 'my-subnet' and region 'REGION', run:
+
+        $ {command} my-subnet --region=REGION --member='user:test-user@gmail.com' --role='roles/compute.securityAdmin'
+
+      To add an IAM policy binding which expires at the end of the year 2018 for the role of
+      'roles/compute.securityAdmin' and the user 'test-user@gmail.com' with subnetwork 'my-subnet' and region 'REGION', run:
+
+        $ {command} my-subnet --region=REGION --member='user:test-user@gmail.com' --role='roles/compute.securityAdmin' --condition='expression=request.time < timestamp("2019-01-01T00:00:00Z"),title=expires_end_of_2018,description=Expires at midnight on 2018-12-31'
+
+      See https://cloud.google.com/iam/docs/managing-policies for details of
+      policy role and member types.

gcloud auth application-default login/google-cloud-sdk/lib/surface/compute/networks/subnets/config/__init__.py

@@ -0,0 +1,26 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for managing Compute Engine subnetwork configurations."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class Config(base.Group):
+  """Manage Compute Engine subnetwork configurations."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/compute/networks/subnets/config/export.yaml

@@ -0,0 +1,38 @@
+release_tracks: [ALPHA]
+command_type: CONFIG_EXPORT
+help_text:
+  brief: Export the configuration for a Compute Engine subnetwork.
+  description: |
+    *{command}* exports the configuration for a Compute Engine subnetwork.
+
+    Subnetwork configurations can be exported in
+    Kubernetes Resource Model (krm) or Terraform HCL formats. The
+    default format is `krm`.
+
+    Specifying `--all` allows you to export the configurations for all
+    subnetworks within the project.
+
+    Specifying `--path` allows you to export the configuration(s) to
+    a local directory.
+  examples: |
+    To export the configuration for a subnetwork, run:
+
+      $ {command} my-subnetwork
+
+    To export the configuration for a subnetwork to a file, run:
+
+      $ {command} my-subnetwork --path=/path/to/dir/
+
+    To export the configuration for a subnetwork in Terraform
+    HCL format, run:
+
+      $ {command} my-subnetwork --resource-format=terraform
+
+    To export the configurations for all subnetworks within a
+    project, run:
+
+      $ {command} --all
+arguments:
+  resource:
+    help_text: Subnetwork to export the configuration for.
+    spec: !REF googlecloudsdk.command_lib.compute.resources:subnet

gcloud auth application-default login/google-cloud-sdk/lib/surface/compute/networks/subnets/create.py

@@ -0,0 +1,660 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2014 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command for creating subnetworks."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.compute import base_classes
+from googlecloudsdk.api_lib.compute import subnets_utils
+from googlecloudsdk.api_lib.compute import utils as compute_api
+from googlecloudsdk.api_lib.util import apis
+from googlecloudsdk.calliope import arg_parsers
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.compute import flags as compute_flags
+from googlecloudsdk.command_lib.compute import resource_manager_tags_utils
+from googlecloudsdk.command_lib.compute.networks import flags as network_flags
+from googlecloudsdk.command_lib.compute.networks.subnets import flags
+from googlecloudsdk.command_lib.util.apis import arg_utils
+import six
+
+
+def _DetailedHelp():
+  return {
+      'brief':
+          'Define a subnet for a network in custom subnet mode.',
+      'DESCRIPTION':
+          """\
+      *{command}* define a subnetwork for a network in custom subnet mode.
+      Subnets must be uniquely named per region.
+      """,
+      'EXAMPLES':
+          """\
+        To create the subnetwork ``subnet-1'' with address range ``10.10.0.0/24'' in the network ``network-0'', run:
+
+        $ {command} subnet-1 --network=network-0 --range=10.10.0.0/24 --region=us-central1
+      """
+  }
+
+
+def _AddArgs(
+    parser,
+    include_alpha_logging,
+    include_aggregate_purpose,
+    include_l2,
+    include_custom_hardware_link,
+    api_version,
+    include_peer_migration_purpose,
+    include_resolve_subnet_mask,
+):
+  """Add subnetwork create arguments to parser."""
+  parser.display_info.AddFormat(flags.DEFAULT_LIST_FORMAT_WITH_IPV6_FIELD)
+
+  flags.SubnetworkArgument().AddArgument(parser, operation_type='create')
+  network_flags.NetworkArgumentForOtherResource(
+      'The network to which the subnetwork belongs.').AddArgument(parser)
+
+  messages = apis.GetMessagesModule('compute',
+                                    compute_api.COMPUTE_GA_API_VERSION)
+
+  parser.add_argument(
+      '--description', help='An optional description of this subnetwork.')
+
+  parser.add_argument(
+      '--range',
+      help='The IP space allocated to this subnetwork in CIDR format.')
+
+  parser.add_argument(
+      '--enable-private-ip-google-access',
+      action='store_true',
+      default=False,
+      help=('Enable/disable access to Google Cloud APIs from this subnet for '
+            'instances without a public ip address.'))
+
+  parser.add_argument(
+      '--secondary-range',
+      type=arg_parsers.ArgDict(min_length=1),
+      action='append',
+      metavar='PROPERTY=VALUE',
+      help="""\
+      Adds a secondary IP range to the subnetwork for use in IP aliasing.
+
+      For example, `--secondary-range range1=192.168.64.0/24` adds
+      a secondary range 192.168.64.0/24 with name range1.
+
+      * `RANGE_NAME` - Name of the secondary range.
+      * `RANGE` - `IP range in CIDR format.`
+      """)
+
+  parser.add_argument(
+      '--enable-flow-logs',
+      action='store_true',
+      default=None,
+      help=('Enable/disable VPC Flow Logs for this subnet. More information '
+            'for VPC Flow Logs can be found at '
+            'https://cloud.google.com/vpc/docs/using-flow-logs.'))
+
+  flags.AddLoggingAggregationInterval(parser, messages)
+  parser.add_argument(
+      '--logging-flow-sampling',
+      type=arg_parsers.BoundedFloat(lower_bound=0.0, upper_bound=1.0),
+      help="""\
+      Can only be specified if VPC Flow Logs for this subnetwork is
+      enabled. The value of the field must be in [0, 1]. Set the sampling rate
+      of VPC flow logs within the subnetwork where 1.0 means all collected
+      logs are reported and 0.0 means no logs are reported. Default is 0.5
+      which means half of all collected logs are reported.
+      """)
+
+  parser.add_argument(
+      '--logging-filter-expr',
+      help="""\
+        Can only be specified if VPC Flow Logs for this subnetwork is enabled.
+        Export filter used to define which logs should be generated.
+        """)
+  flags.AddLoggingMetadata(parser, messages)
+  parser.add_argument(
+      '--logging-metadata-fields',
+      type=arg_parsers.ArgList(),
+      metavar='METADATA_FIELD',
+      default=None,
+      help="""\
+      Can only be specified if VPC Flow Logs for this subnetwork is enabled
+      and "metadata" is set to CUSTOM_METADATA. The comma-separated list of
+      metadata fields that should be added to reported logs.
+      """)
+
+  if include_alpha_logging:
+    messages = apis.GetMessagesModule('compute',
+                                      compute_api.COMPUTE_ALPHA_API_VERSION)
+    flags.AddLoggingAggregationIntervalDeprecated(parser, messages)
+    parser.add_argument(
+        '--flow-sampling',
+        type=arg_parsers.BoundedFloat(lower_bound=0.0, upper_bound=1.0),
+        help="""\
+        Can only be specified if VPC flow logging for this subnetwork is
+        enabled. The value of the field must be in [0, 1]. Set the sampling rate
+        of VPC flow logs within the subnetwork where 1.0 means all collected
+        logs are reported and 0.0 means no logs are reported. Default is 0.5
+        which means half of all collected logs are reported.
+        """)
+    flags.AddLoggingMetadataDeprecated(parser, messages)
+
+  purpose_choices = {
+      'PRIVATE': 'Regular user created or automatically created subnet.',
+      'INTERNAL_HTTPS_LOAD_BALANCER': (
+          'Reserved for Internal HTTP(S) Load Balancing.'
+      ),
+      'REGIONAL_MANAGED_PROXY': (
+          'Reserved for Regional Envoy-based Load Balancing.'
+      ),
+      'GLOBAL_MANAGED_PROXY': (
+          'Reserved for Global Envoy-based  Load Balancing.'
+      ),
+      'PRIVATE_SERVICE_CONNECT': (
+          'Reserved for Private Service Connect Internal Load Balancing.'
+      ),
+      'PRIVATE_NAT': 'Reserved for use as source range for Private NAT.',
+      'PEER_MIGRATION': 'Reserved for subnet migration between peered VPCs.',
+  }
+
+  if include_aggregate_purpose:
+    purpose_choices['AGGREGATE'] = (
+        'Reserved for Aggregate Ranges used for aggregating '
+        'private subnetworks.'
+    )
+
+  if include_custom_hardware_link:
+    purpose_choices['CUSTOM_HARDWARE_LINK'] = (
+        'Reserved for Custom Hardware Link.'
+    )
+
+  if include_peer_migration_purpose:
+    purpose_choices['PEER_MIGRATION'] = (
+        'Reserved for subnet migration between peered VPCs.'
+    )
+
+  # Subnetwork purpose is introduced with L7ILB feature. Aggregate purpose
+  # will have to be enabled for a given release track only after L7ILB feature
+  # is enabled for that release track. Hence if include_aggregate_purpose
+  # true, this code assumes that L7ILB purpose is enabled.
+  parser.add_argument(
+      '--purpose',
+      choices=purpose_choices,
+      type=arg_utils.ChoiceToEnumName,
+      help='The purpose of this subnetwork.')
+
+  parser.add_argument(
+      '--role',
+      choices={
+          'ACTIVE': 'The ACTIVE subnet that is currently used.',
+          'BACKUP': 'The BACKUP subnet that could be promoted to ACTIVE.',
+      },
+      type=lambda x: x.replace('-', '_').upper(),
+      help=(
+          'The role of subnetwork. This field is required when the purpose is'
+          ' set to GLOBAL_MANAGED_PROXY, REGIONAL_MANAGED_PROXY or'
+          ' INTERNAL_HTTPS_LOAD_BALANCER.'
+      ),
+  )
+
+  # Add private ipv6 google access enum based on api version.
+  messages = apis.GetMessagesModule('compute', api_version)
+  GetPrivateIpv6GoogleAccessTypeFlagMapper(messages).choice_arg.AddToParser(
+      parser)
+
+  stack_type_choices = {
+      'IPV4_ONLY': (
+          'New VMs in this subnet will only be assigned IPv4 addresses'
+      ),
+      'IPV4_IPV6': (
+          'New VMs in this subnet can have both IPv4 and IPv6 addresses'
+      ),
+      'IPV6_ONLY': (
+          'New VMs in this subnet will only be assigned IPv6 addresses'
+      )
+  }
+
+  parser.add_argument(
+      '--stack-type',
+      choices=stack_type_choices,
+      type=arg_utils.ChoiceToEnumName,
+      help=(
+          'The stack type for this subnet. Determines if IPv6 is enabled '
+          'on the subnet. If not specified IPV4_ONLY will be used.'
+      ),
+  )
+
+  ipv6_access_type_choices = {
+      'EXTERNAL': 'VMs in this subnet can have external IPv6.',
+      'INTERNAL': 'VMs in this subnet can have internal IPv6.'
+  }
+  parser.add_argument(
+      '--ipv6-access-type',
+      choices=ipv6_access_type_choices,
+      type=arg_utils.ChoiceToEnumName,
+      help=(
+          'IPv6 access type can be specified only when the subnet is '
+          'created, or when the subnet is first updated to have a stack '
+          'type of IPV4_IPV6. Once set, the access type is immutable.'
+      ),
+  )
+
+  parser.display_info.AddCacheUpdater(network_flags.NetworksCompleter)
+
+  if include_l2:
+    l2_args = parser.add_group(help='L2 networking specifications.')
+    l2_args.add_argument(
+        '--enable-l2',
+        action='store_true',
+        required=True,
+        help="""\
+        If set to true, enables l2 networking capability on subnetwork.
+        """)
+    l2_args.add_argument(
+        '--vlan',
+        type=int,
+        metavar='VLAN',
+        help="""\
+        Specifies ID of the vlan to tag the subnetwork.
+        """)
+
+  parser.add_argument(
+      '--reserved-internal-range',
+      help=("""
+      If set, the primary IP range of the subnetwork will be
+      associated with the given internal range resource.
+      If --range is set, the subnetwork will only use the given IP range,
+      which must be contained by the IP range defined by the internal range resource.
+      For example,
+      --range=10.0.0.0/24
+      --reserved-internal-range //networkconnectivity.googleapis.com/projects/PROJECT/locations/global/internalRanges/RANGE
+      If --range is not set, the subnetwork will use the entire IP range
+      defined by the internal range resource.
+      For example, `--reserved-internal-range //networkconnectivity.googleapis.com/projects/PROJECT/locations/global/internalRanges/RANGE`
+      """),
+  )
+  parser.add_argument(
+      '--secondary-range-with-reserved-internal-range',
+      type=arg_parsers.ArgDict(min_length=1),
+      action='append',
+      metavar='RANGE_NAME=INTERNAL_RANGE_URL',
+      help="""\
+       Adds secondary IP ranges that are associated with internal range
+       resources.
+       For example, `--secondary-range-with-reserved-internal-range
+       range1=//networkconnectivity.googleapis.com/projects/PROJECT/locations/global/internalRanges/RANGE`
+       adds a secondary range with the reserved internal range resource.
+       * `RANGE_NAME` - Name of the secondary range.
+       * `INTERNAL_RANGE_URL` - `URL of an internal range resource.`
+      """,
+  )
+
+  parser.add_argument(
+      '--external-ipv6-prefix',
+      help=("""
+      The /64 external IPv6 CIDR range to assign to this subnet. The range must
+      be associated with an IPv6 BYOIP sub-prefix that is defined by the
+      --ip-collection flag. If you specify --ip-collection but not
+      --external-ipv6-prefix, a random /64 range is allocated from
+      the sub-prefix.
+
+      For example, `--external-ipv6-prefix=2600:1901:0:0:0:0:0:0/64`
+      """),
+  )
+
+  parser.add_argument(
+      '--internal-ipv6-prefix',
+      help=("""
+      The /64 internal IPv6 CIDR range to assign to this subnet. The range must
+      be associated with an IPv6 BYOIP sub-prefix that is defined by the
+      --ip-collection flag. If you specify --ip-collection but not
+      --internal-ipv6-prefix, a random /64 range is allocated from the
+      sub-prefix.
+
+      For example, `--internal-ipv6-prefix 2600:1901:0:0:0:0:0:0/64`
+      """),
+  )
+
+  parser.add_argument(
+      '--resource-manager-tags',
+      type=arg_parsers.ArgDict(),
+      metavar='KEY=VALUE',
+      help="""\
+          A comma-separated list of Resource Manager tags to apply to the subnetwork.
+      """,
+  )
+
+  if include_resolve_subnet_mask:
+    resolve_subnet_mask_choices = {
+        'ARP_ALL_RANGES': """
+        VMs connected to this subnet receive ARP responses for IPv4
+        addresses from any ranges of the subnet that are assigned to the VM's
+        NIC. The DHCP responses contain the netmask of the subnet, instead of
+        /32.
+        """,
+        'ARP_PRIMARY_RANGE': """
+        VMs connected to this subnet receive ARP responses only for IP
+        addresses in the primary IPv4 range of the subnet. DHCP responses
+        contain the netmask of the subnet, instead of /32.
+        """,
+    }
+
+    parser.add_argument(
+        '--resolve-subnet-mask',
+        choices=resolve_subnet_mask_choices,
+        type=arg_utils.ChoiceToEnumName,
+        help='Resolve subnet mask can only be set when subnet is created.',
+    )
+
+  flags.IpCollectionArgument().AddArgument(parser)
+
+
+def GetPrivateIpv6GoogleAccessTypeFlagMapper(messages):
+  return arg_utils.ChoiceEnumMapper(
+      '--private-ipv6-google-access-type',
+      messages.Subnetwork.PrivateIpv6GoogleAccessValueValuesEnum,
+      custom_mappings={
+          'DISABLE_GOOGLE_ACCESS':
+              'disable',
+          'ENABLE_BIDIRECTIONAL_ACCESS_TO_GOOGLE':
+              'enable-bidirectional-access',
+          'ENABLE_OUTBOUND_VM_ACCESS_TO_GOOGLE':
+              'enable-outbound-vm-access'
+      },
+      help_str='The private IPv6 google access type for the VMs in this subnet.'
+  )
+
+
+def _CreateSubnetwork(
+    messages,
+    subnet_ref,
+    network_ref,
+    args,
+    include_alpha_logging,
+    include_aggregate_purpose,
+    include_l2,
+    include_custom_hardware_link,
+    ip_collection_ref,
+    include_peer_migration_purpose,
+    include_resolve_subnet_mask,
+):
+  """Create the subnet resource."""
+  subnetwork = messages.Subnetwork(
+      name=subnet_ref.Name(),
+      description=args.description,
+      network=network_ref.SelfLink(),
+      privateIpGoogleAccess=args.enable_private_ip_google_access)
+
+  if args.range:
+    subnetwork.ipCidrRange = args.range
+
+  if (args.enable_flow_logs is not None or
+      args.logging_aggregation_interval is not None or
+      args.logging_flow_sampling is not None or
+      args.logging_metadata is not None or
+      args.logging_filter_expr is not None or
+      args.logging_metadata_fields is not None):
+    log_config = messages.SubnetworkLogConfig(enable=args.enable_flow_logs)
+    if args.logging_aggregation_interval:
+      log_config.aggregationInterval = flags.GetLoggingAggregationIntervalArg(
+          messages).GetEnumForChoice(args.logging_aggregation_interval)
+    if args.logging_flow_sampling is not None:
+      log_config.flowSampling = args.logging_flow_sampling
+    if args.logging_metadata:
+      log_config.metadata = flags.GetLoggingMetadataArg(
+          messages).GetEnumForChoice(args.logging_metadata)
+    if args.logging_filter_expr is not None:
+      log_config.filterExpr = args.logging_filter_expr
+    if args.logging_metadata_fields is not None:
+      log_config.metadataFields = args.logging_metadata_fields
+    subnetwork.logConfig = log_config
+
+  if include_alpha_logging:
+    if (args.enable_flow_logs is not None or
+        args.aggregation_interval is not None or
+        args.flow_sampling is not None or args.metadata is not None):
+      log_config = (
+          subnetwork.logConfig if subnetwork.logConfig is not None else
+          messages.SubnetworkLogConfig(enable=args.enable_flow_logs))
+      if args.aggregation_interval:
+        log_config.aggregationInterval = (
+            flags.GetLoggingAggregationIntervalArgDeprecated(
+                messages).GetEnumForChoice(args.aggregation_interval))
+      if args.flow_sampling is not None:
+        log_config.flowSampling = args.flow_sampling
+      if args.metadata:
+        log_config.metadata = flags.GetLoggingMetadataArgDeprecated(
+            messages).GetEnumForChoice(args.metadata)
+      if args.logging_filter_expr is not None:
+        log_config.filterExpr = args.logging_filter_expr
+      if args.logging_metadata_fields is not None:
+        log_config.metadataFields = args.logging_metadata_fields
+      subnetwork.logConfig = log_config
+
+  if args.purpose:
+    subnetwork.purpose = messages.Subnetwork.PurposeValueValuesEnum(
+        args.purpose)
+  if (
+      subnetwork.purpose
+      == messages.Subnetwork.PurposeValueValuesEnum.INTERNAL_HTTPS_LOAD_BALANCER
+      or subnetwork.purpose
+      == messages.Subnetwork.PurposeValueValuesEnum.REGIONAL_MANAGED_PROXY
+      or subnetwork.purpose
+      == messages.Subnetwork.PurposeValueValuesEnum.GLOBAL_MANAGED_PROXY
+      or subnetwork.purpose
+      == messages.Subnetwork.PurposeValueValuesEnum.PRIVATE_SERVICE_CONNECT
+      or (
+          include_peer_migration_purpose
+          and subnetwork.purpose
+          == messages.Subnetwork.PurposeValueValuesEnum.PEER_MIGRATION
+      )
+      or (
+          include_aggregate_purpose
+          and subnetwork.purpose
+          == messages.Subnetwork.PurposeValueValuesEnum.AGGREGATE
+      )
+      or (
+          include_custom_hardware_link
+          and subnetwork.purpose
+          == messages.Subnetwork.PurposeValueValuesEnum.CUSTOM_HARDWARE_LINK
+      )
+  ):
+    # Clear unsupported fields in the subnet resource
+    subnetwork.privateIpGoogleAccess = None
+    subnetwork.enableFlowLogs = None
+    subnetwork.logConfig = None
+  if getattr(args, 'role', None):
+    subnetwork.role = messages.Subnetwork.RoleValueValuesEnum(args.role)
+
+  if args.private_ipv6_google_access_type is not None:
+    subnetwork.privateIpv6GoogleAccess = (
+        flags.GetPrivateIpv6GoogleAccessTypeFlagMapper(
+            messages).GetEnumForChoice(args.private_ipv6_google_access_type))
+
+  if args.stack_type:
+    subnetwork.stackType = messages.Subnetwork.StackTypeValueValuesEnum(
+        args.stack_type)
+
+  if args.ipv6_access_type:
+    subnetwork.ipv6AccessType = (
+        messages.Subnetwork.Ipv6AccessTypeValueValuesEnum(
+            args.ipv6_access_type))
+
+  if include_l2 and args.enable_l2:
+    subnetwork.enableL2 = True
+    if args.vlan is not None:
+      subnetwork.vlans.append(args.vlan)
+
+  if args.reserved_internal_range:
+    subnetwork.reservedInternalRange = args.reserved_internal_range
+
+  if args.external_ipv6_prefix:
+    subnetwork.externalIpv6Prefix = args.external_ipv6_prefix
+
+  if args.internal_ipv6_prefix:
+    subnetwork.internalIpv6Prefix = args.internal_ipv6_prefix
+
+  if ip_collection_ref:
+    subnetwork.ipCollection = ip_collection_ref.SelfLink()
+
+  if args.resource_manager_tags is not None:
+    subnetwork.params = _CreateSubnetworkParams(
+        messages, args.resource_manager_tags
+    )
+
+  if include_resolve_subnet_mask:
+    if args.resolve_subnet_mask:
+      subnetwork.resolveSubnetMask = (
+          messages.Subnetwork.ResolveSubnetMaskValueValuesEnum(
+              args.resolve_subnet_mask
+          )
+      )
+  return subnetwork
+
+
+def _CreateSubnetworkParams(messages, resource_manager_tags):
+  resource_manager_tags_map = (
+      resource_manager_tags_utils.GetResourceManagerTags(resource_manager_tags)
+  )
+  params = messages.SubnetworkParams
+  additional_properties = [
+      params.ResourceManagerTagsValue.AdditionalProperty(key=key, value=value)
+      for key, value in sorted(six.iteritems(resource_manager_tags_map))
+  ]
+  return params(
+      resourceManagerTags=params.ResourceManagerTagsValue(
+          additionalProperties=additional_properties
+      )
+  )
+
+
+def _Run(
+    args,
+    holder,
+    include_alpha_logging,
+    include_aggregate_purpose,
+    include_l2,
+    include_custom_hardware_link,
+    include_peer_migration_purpose,
+    include_resolve_subnet_mask,
+):
+  """Issues a list of requests necessary for adding a subnetwork."""
+  client = holder.client
+
+  network_ref = network_flags.NetworkArgumentForOtherResource(
+      'The network to which the subnetwork belongs.').ResolveAsResource(
+          args, holder.resources)
+  subnet_ref = flags.SubnetworkArgument().ResolveAsResource(
+      args,
+      holder.resources,
+      scope_lister=compute_flags.GetDefaultScopeLister(client))
+  ip_collection_ref = None
+  if args.ip_collection:
+    ip_collection_ref = flags.IpCollectionArgument().ResolveAsResource(
+        args, holder.resources)
+
+  subnetwork = _CreateSubnetwork(
+      client.messages,
+      subnet_ref,
+      network_ref,
+      args,
+      include_alpha_logging,
+      include_aggregate_purpose,
+      include_l2,
+      include_custom_hardware_link,
+      ip_collection_ref,
+      include_peer_migration_purpose,
+      include_resolve_subnet_mask,
+  )
+  request = client.messages.ComputeSubnetworksInsertRequest(
+      subnetwork=subnetwork,
+      region=subnet_ref.region,
+      project=subnet_ref.project)
+
+  secondary_ranges = subnets_utils.CreateSecondaryRanges(
+      client,
+      args.secondary_range,
+      args.secondary_range_with_reserved_internal_range,
+  )
+
+  request.subnetwork.secondaryIpRanges = secondary_ranges
+  return client.MakeRequests([(client.apitools_client.subnetworks, 'Insert',
+                               request)])
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class Create(base.CreateCommand):
+  """Create a GA subnet."""
+
+  _include_alpha_logging = False
+  _include_aggregate_purpose = False
+  _include_l2 = False
+  _api_version = compute_api.COMPUTE_GA_API_VERSION
+  _include_custom_hardware_link = False
+  _include_peer_migration_purpose = True
+  _include_resolve_subnet_mask = False
+
+  detailed_help = _DetailedHelp()
+
+  @classmethod
+  def Args(cls, parser):
+    _AddArgs(
+        parser,
+        cls._include_alpha_logging,
+        cls._include_aggregate_purpose,
+        cls._include_l2,
+        cls._include_custom_hardware_link,
+        cls._api_version,
+        cls._include_peer_migration_purpose,
+        cls._include_resolve_subnet_mask,
+    )
+
+  def Run(self, args):
+    """Issues a list of requests necessary for adding a subnetwork."""
+    holder = base_classes.ComputeApiHolder(self.ReleaseTrack())
+    return _Run(
+        args,
+        holder,
+        self._include_alpha_logging,
+        self._include_aggregate_purpose,
+        self._include_l2,
+        self._include_custom_hardware_link,
+        self._include_peer_migration_purpose,
+        self._include_resolve_subnet_mask,
+    )
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+class CreateBeta(Create):
+  """Create a subnet in the Beta release track."""
+
+  _api_version = compute_api.COMPUTE_BETA_API_VERSION
+  _include_resolve_subnet_mask = True
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class CreateAlpha(CreateBeta):
+  """Create a subnet in the Alpha release track."""
+
+  _include_alpha_logging = True
+  _include_aggregate_purpose = True
+  _include_l2 = True
+  _api_version = compute_api.COMPUTE_ALPHA_API_VERSION
+  _include_custom_hardware_link = True
+  _include_peer_migration_purpose = True
+  _include_resolve_subnet_mask = True

gcloud auth application-default login/google-cloud-sdk/lib/surface/compute/networks/subnets/delete.py

@@ -0,0 +1,82 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2015 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command for deleting subnetworks."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.compute import base_classes
+from googlecloudsdk.api_lib.compute import utils
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.compute import flags as compute_flags
+from googlecloudsdk.command_lib.compute.networks.subnets import flags
+
+
+def _DetailedHelp():
+  return {
+      'brief':
+          'Delete Google Cloud subnetworks.',
+      'DESCRIPTION':
+      """\
+          *{command}* deletes one or more Google Cloud subnetworks.
+          Subnetworks can only be deleted when no other resources,
+          such as VM instances, refer to them.".
+      """,
+      'EXAMPLES':
+          """\
+        To delete the subnetwork subnet-1 in the us-central1,
+        run:
+
+        $ {command} subnet-1 --region=us-central1
+      """
+  }
+
+
+class Delete(base.DeleteCommand):
+  """Delete Compute Engine subnetworks.
+
+  *{command}* deletes one or more Compute Engine
+  subnetworks. Subnetworks can only be deleted when no other resources
+  (e.g., virtual machine instances) refer to them.
+  """
+
+  SUBNET_ARG = None
+  detailed_help = _DetailedHelp()
+
+  @staticmethod
+  def Args(parser):
+    Delete.SUBNET_ARG = flags.SubnetworkArgument(plural=True)
+    Delete.SUBNET_ARG.AddArgument(parser, operation_type='delete')
+    parser.display_info.AddCacheUpdater(flags.SubnetworksCompleter)
+
+  def Run(self, args):
+    holder = base_classes.ComputeApiHolder(self.ReleaseTrack())
+    client = holder.client
+
+    subnet_refs = Delete.SUBNET_ARG.ResolveAsResource(
+        args,
+        holder.resources,
+        scope_lister=compute_flags.GetDefaultScopeLister(client))
+
+    utils.PromptForDeletion(subnet_refs, 'region')
+
+    requests = []
+    for subnet_ref in subnet_refs:
+      requests.append((client.apitools_client.subnetworks, 'Delete',
+                       client.messages.ComputeSubnetworksDeleteRequest(
+                           **subnet_ref.AsDict())))
+
+    return client.MakeRequests(requests)

gcloud auth application-default login/google-cloud-sdk/lib/surface/compute/networks/subnets/describe.py

@@ -0,0 +1,123 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2015 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Command for describing subnetworks."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.compute import base_classes
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.compute import flags as compute_flags
+from googlecloudsdk.command_lib.compute.networks.subnets import flags
+from googlecloudsdk.command_lib.util.apis import arg_utils
+
+
+def _DetailedHelp():
+  return {
+      'brief': 'Describe a Compute Engine subnetwork.',
+      'DESCRIPTION': """\
+          *{command}* displays all data associated with a Compute Engine
+          subnetwork.
+      """,
+      'EXAMPLES': """\
+        To display all data associated with subnetwork subnet-1, run:
+
+        $ {command} subnet-1
+      """,
+  }
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class Describe(base.DescribeCommand):
+  """Describe a Compute Engine subnetwork.
+
+  *{command}* displays all data associated with a Compute Engine
+  subnetwork.
+  """
+
+  _include_view = True
+
+  SUBNETWORK_ARG = None
+  detailed_help = _DetailedHelp()
+
+  @classmethod
+  def Args(cls, parser):
+    Describe.SUBNETWORK_ARG = flags.SubnetworkArgument()
+    Describe.SUBNETWORK_ARG.AddArgument(parser, operation_type='describe')
+    if cls._include_view:
+      parser.add_argument(
+          '--view',
+          choices={
+              'WITH_UTILIZATION': (
+                  'Output includes the IP address utilization data of all'
+                  ' subnetwork ranges, showing total allocated and free IPv4'
+                  ' and IPv6 IP addresses.'
+              ),
+          },
+          type=arg_utils.ChoiceToEnumName,
+          action='append',
+          help=(
+              'Specifies the information to include in the output.'
+          ),
+      )
+
+  def _GetSubnetworkViews(self, view, request_message):
+    views = []
+    for v in view:
+      if v == 'WITH_UTILIZATION':
+        views.append(request_message.ViewsValueValuesEnum.WITH_UTILIZATION)
+    return views
+
+  def Run(self, args):
+    holder = base_classes.ComputeApiHolder(self.ReleaseTrack())
+    client = holder.client
+
+    subnetwork_ref = Describe.SUBNETWORK_ARG.ResolveAsResource(
+        args,
+        holder.resources,
+        scope_lister=compute_flags.GetDefaultScopeLister(client),
+    )
+
+    request = client.messages.ComputeSubnetworksGetRequest(
+        **subnetwork_ref.AsDict()
+    )
+
+    if self._include_view and args.view:
+      request.views = self._GetSubnetworkViews(
+          args.view, client.messages.ComputeSubnetworksGetRequest
+      )
+
+    return client.MakeRequests(
+        [(client.apitools_client.subnetworks, 'Get', request)]
+    )[0]
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+@base.UniverseCompatible
+class DescribeBeta(Describe):
+  """Create a subnet in the Beta release track."""
+
+  _include_view = True
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+@base.UniverseCompatible
+class DescribeAlpha(DescribeBeta):
+  """Describe a subnet in the Alpha release track."""
+
+  _include_view = True

gcloud auth application-default login/google-cloud-sdk/lib/surface/compute/networks/subnets/expand_ip_range.py

@@ -0,0 +1,149 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2016 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command for expanding IP range of a subnetwork."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.compute import base_classes
+from googlecloudsdk.calliope import base
+from googlecloudsdk.calliope import exceptions as exceptions
+from googlecloudsdk.command_lib.compute import exceptions as compute_exceptions
+from googlecloudsdk.command_lib.compute.networks.subnets import flags
+from googlecloudsdk.core.console import console_io
+import ipaddress
+import six
+
+
+@base.ReleaseTracks(base.ReleaseTrack.GA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.ALPHA)
+class ExpandIpRange(base.SilentCommand):
+  """Expand IP range of a subnetwork."""
+
+  SUBNETWORK_ARG = None
+
+  @classmethod
+  def Args(cls, parser):
+    cls.SUBNETWORK_ARG = flags.SubnetworkArgument()
+    cls.SUBNETWORK_ARG.AddArgument(parser)
+
+    parser.add_argument(
+        '--prefix-length',
+        type=int,
+        help=(
+            'The new prefix length of the subnet. It must be smaller than the '
+            'original and in the private address space 10.0.0.0/8, '
+            '172.16.0.0/12 or 192.168.0.0/16 defined in RFC 1918.'),
+        required=True)
+
+  def Run(self, args):
+    """Issues requests for expanding IP CIDR range."""
+    holder = base_classes.ComputeApiHolder(self.ReleaseTrack())
+    client = holder.client
+
+    new_prefix_length = self._ValidatePrefixLength(args.prefix_length)
+    subnetwork_ref = self.SUBNETWORK_ARG.ResolveAsResource(
+        args, holder.resources)
+    original_ip_cidr_range = self._GetOriginalIpCidrRange(
+        client, subnetwork_ref)
+    new_ip_cidr_range = self._InferNewIpCidrRange(
+        subnetwork_ref.Name(), original_ip_cidr_range, new_prefix_length)
+    self._PromptToConfirm(
+        subnetwork_ref.Name(), original_ip_cidr_range, new_ip_cidr_range)
+    request = self._CreateExpandIpCidrRangeRequest(client, subnetwork_ref,
+                                                   new_ip_cidr_range)
+    return client.MakeRequests([(client.apitools_client.subnetworks,
+                                 'ExpandIpCidrRange', request)])
+
+  def _ValidatePrefixLength(self, new_prefix_length):
+    if not 0 <= new_prefix_length <= 29:
+      raise exceptions.InvalidArgumentException(
+          '--prefix-length',
+          'Prefix length must be in the range [0, 29].')
+    return new_prefix_length
+
+  def _GetOriginalIpCidrRange(self, client, subnetwork_ref):
+    subnetwork = self._GetSubnetwork(client, subnetwork_ref)
+    if not subnetwork:
+      raise compute_exceptions.ArgumentError(
+          'Subnet [{subnet}] was not found in region {region}.'.format(
+              subnet=subnetwork_ref.Name(), region=subnetwork_ref.region))
+
+    return subnetwork.ipCidrRange
+
+  def _InferNewIpCidrRange(
+      self, subnet_name, original_ip_cidr_range, new_prefix_length):
+    unmasked_new_ip_range = '{0}/{1}'.format(
+        original_ip_cidr_range.split('/')[0],
+        new_prefix_length)
+    # ipaddress only allows unicode input
+    network = ipaddress.IPv4Network(six.text_type(unmasked_new_ip_range),
+                                    strict=False)
+    return six.text_type(network)
+
+  def _PromptToConfirm(
+      self, subnetwork_name, original_ip_cidr_range, new_ip_cidr_range):
+    prompt_message_template = (
+        'The IP range of subnetwork [{0}] will be expanded from {1} to {2}. '
+        'This operation may take several minutes to complete '
+        'and cannot be undone.')
+    prompt_message = prompt_message_template.format(
+        subnetwork_name, original_ip_cidr_range, new_ip_cidr_range)
+    if not console_io.PromptContinue(message=prompt_message, default=True):
+      raise compute_exceptions.AbortedError('Operation aborted by user.')
+
+  def _CreateExpandIpCidrRangeRequest(self, client, subnetwork_ref,
+                                      new_ip_cidr_range):
+    request_body = client.messages.SubnetworksExpandIpCidrRangeRequest(
+        ipCidrRange=new_ip_cidr_range)
+    return client.messages.ComputeSubnetworksExpandIpCidrRangeRequest(
+        subnetwork=subnetwork_ref.Name(),
+        subnetworksExpandIpCidrRangeRequest=request_body,
+        project=subnetwork_ref.project,
+        region=subnetwork_ref.region)
+
+  def _GetSubnetwork(self, client, subnetwork_ref):
+    get_request = (
+        client.apitools_client.subnetworks,
+        'Get',
+        client.messages.ComputeSubnetworksGetRequest(
+            project=subnetwork_ref.project,
+            region=subnetwork_ref.region,
+            subnetwork=subnetwork_ref.Name()))
+
+    objects = client.MakeRequests([get_request])
+
+    return objects[0] if objects else None
+
+
+ExpandIpRange.detailed_help = {
+    'brief': 'Expand the IP range of a Compute Engine subnetwork',
+    'DESCRIPTION': """
+*{command}* expands the IP range of a VPC subnetwork.
+
+For more information about expanding a subnet, see [Expanding a primary IP
+range](https://cloud.google.com/vpc/docs/using-vpc#expand-subnet).
+
+This command doesn't work for secondary subnets or for subnets that are used
+exclusively for load balancer proxies. For more information, see [Proxy-only
+subnets for load balancers](https://cloud.google.com/load-balancing/docs/l7-internal/proxy-only-subnets).
+""",
+    'EXAMPLES': """
+To expand the IP range of ``SUBNET'' to /16, run:
+
+  $ {command} SUBNET --region=us-central1 --prefix-length=16
+""",
+}

gcloud auth application-default login/google-cloud-sdk/lib/surface/compute/networks/subnets/get_iam_policy.yaml

@@ -0,0 +1,34 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Get the IAM policy for a Compute Engine subnetwork.
+    description: |
+      *{command}* displays the IAM policy associated with a
+      Compute Engine subnetwork in a project. If formatted as JSON,
+      the output can be edited and used as a policy file for
+      set-iam-policy. The output includes an "etag" field
+      identifying the version emitted and allowing detection of
+      concurrent policy updates; see
+      $ {parent} set-iam-policy for additional details.
+    examples: |
+      To print the IAM policy for a given subnetwork, run:
+
+        $ {command} my-subnet --region=REGION
+
+  request:
+    collection: compute.subnetworks
+    use_relative_name: false
+    api_version: v1
+    BETA:
+      api_version: beta
+      modify_request_hooks:
+      - googlecloudsdk.command_lib.iam.hooks:UseMaxRequestedPolicyVersion:api_field=optionsRequestedPolicyVersion
+    ALPHA:
+      api_version: alpha
+      modify_request_hooks:
+      - googlecloudsdk.command_lib.iam.hooks:UseMaxRequestedPolicyVersion:api_field=optionsRequestedPolicyVersion
+
+  arguments:
+    resource:
+      help_text: The network to display the IAM policy for.
+      spec: !REF googlecloudsdk.command_lib.compute.resources:subnet

gcloud auth application-default login/google-cloud-sdk/lib/surface/compute/networks/subnets/list.py

@@ -0,0 +1,128 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2015 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Command for listing subnetworks."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.compute import base_classes
+from googlecloudsdk.api_lib.compute import lister
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.compute.networks.subnets import flags
+from googlecloudsdk.command_lib.util.apis import arg_utils
+
+
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+@base.UniverseCompatible
+class List(base.ListCommand):
+  """List subnetworks."""
+
+  _include_view = True
+
+  _default_list_format = flags.DEFAULT_LIST_FORMAT_WITH_IPV6_FIELD
+  _utilization_details_list_format = (
+      flags.DEFAULT_LIST_FORMAT_WITH_UTILIZATION_FIELD
+  )
+
+  @classmethod
+  def Args(cls, parser):
+
+    if cls._include_view:
+      parser.display_info.AddFormat(cls._utilization_details_list_format)
+    else:
+      parser.display_info.AddFormat(cls._default_list_format)
+    lister.AddRegionsArg(parser)
+    parser.display_info.AddCacheUpdater(flags.SubnetworksCompleter)
+
+    parser.add_argument(
+        '--network',
+        help='Only show subnetworks of a specific network.')
+
+    if cls._include_view:
+      parser.add_argument(
+          '--view',
+          choices={
+              'WITH_UTILIZATION': (
+                  'Output includes the IP address utilization data of all'
+                  ' subnetwork ranges, showing total allocated and free IPv4'
+                  ' and IPv6 IP addresses.'
+              ),
+          },
+          type=arg_utils.ChoiceToEnumName,
+          action='append',
+          help=(
+              'Specifies the information to include in the output.'
+          ),
+      )
+
+  def _GetSubnetworkViews(self, view, request_message):
+    views = []
+    if view is None:
+      return views
+    for v in view:
+      if v == 'WITH_UTILIZATION':
+        views.append(request_message.ViewsValueValuesEnum.WITH_UTILIZATION)
+    return views
+
+  def Run(self, args):
+    holder = base_classes.ComputeApiHolder(self.ReleaseTrack())
+    client = holder.client
+
+    request_data = lister.ParseMultiScopeFlags(args, holder.resources)
+
+    if self._include_view:
+      list_implementation = lister.MultiScopeLister(
+          client=client,
+          regional_service=client.apitools_client.subnetworks,
+          aggregation_service=client.apitools_client.subnetworks,
+          subnetwork_views_flag=self._GetSubnetworkViews(
+              args.view, client.messages.ComputeSubnetworksListRequest
+          ),
+      )
+    else:
+      list_implementation = lister.MultiScopeLister(
+          client=client,
+          regional_service=client.apitools_client.subnetworks,
+          aggregation_service=client.apitools_client.subnetworks,
+      )
+
+    for resource in lister.Invoke(request_data, list_implementation):
+      if args.network is None:
+        yield resource
+      elif 'network' in resource:
+        network_ref = holder.resources.Parse(resource['network'])
+        if network_ref.Name() == args.network:
+          yield resource
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+@base.UniverseCompatible
+class ListBeta(List):
+  """Create a subnet in the Beta release track."""
+
+  _include_view = True
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+@base.UniverseCompatible
+class ListAlpha(ListBeta):
+  """Describe a subnet in the Alpha release track."""
+
+  _include_view = True
+
+
+List.detailed_help = base_classes.GetRegionalListerHelp('subnetworks')

gcloud auth application-default login/google-cloud-sdk/lib/surface/compute/networks/subnets/list_usable.py

@@ -0,0 +1,127 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2016 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command for list subnetworks which the current user has permission to use."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from apitools.base.py import list_pager
+from googlecloudsdk.api_lib.compute import base_classes
+from googlecloudsdk.calliope import base
+from googlecloudsdk.core import properties
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(
+    base.ReleaseTrack.GA, base.ReleaseTrack.BETA, base.ReleaseTrack.ALPHA
+)
+class ListUsableSubnets(base.ListCommand):
+  """List subnetworks which the current user has permission to use."""
+
+  detailed_help = {
+      'brief': """\
+          List Compute Engine subnetworks permitted for use.
+          """,
+      'DESCRIPTION': """\
+          *{command}* is used to list Compute Engine subnetworks in a
+          project that the user has permission to use.
+
+          By default, usable subnetworks are listed for the default Google Cloud
+          project and user account. These values can be overridden by
+          setting the global flags: `--project=PROJECT_ID` and/or
+          `--account=ACCOUNT`.
+          """,
+      'EXAMPLES': """\
+            To list all subnetworks in the default project that are usable by the
+            default user:
+
+              $ {command}
+
+            To list all subnetworks in the host project ``HOST_PROJECT_ID'' of
+            Shared VPC that are usable in the service project ``SERVICE_PROJECT_ID''
+            (see [Shared VPC documentation](https://cloud.google.com/vpc/docs/shared-vpc/))
+            by the default user:
+
+              $ {command} --project=HOST_PROJECT_ID --service-project=SERVICE_PROJECT_ID
+
+            To list all subnetworks in the project ``PROJECT_ID'' that are usable
+            by the user ``ACCOUNT'':
+
+              $ {command} --project=PROJECT_ID --account=ACCOUNT
+          """,
+  }
+
+  @staticmethod
+  def _EnableComputeApi():
+    return properties.VALUES.compute.use_new_list_usable_subnets_api.GetBool()
+
+  @classmethod
+  def Args(cls, parser):
+    parser.display_info.AddFormat("""\
+        table(
+          subnetwork.segment(-5):label=PROJECT,
+          subnetwork.segment(-3):label=REGION,
+          network.segment(-1):label=NETWORK,
+          subnetwork.segment(-1):label=SUBNET,
+          ipCidrRange:label=RANGE,
+          secondaryIpRanges.map().format("{0} {1}", rangeName, ipCidrRange).list(separator="\n"):label=SECONDARY_RANGES,
+          purpose,
+          role,
+          stackType,
+          ipv6AccessType,
+          internalIpv6Prefix,
+          externalIpv6Prefix
+        )""")
+
+    parser.add_argument(
+        '--service-project',
+        required=False,
+        help="""\
+        The project id or project number in which the subnetwork is intended to be
+        used. Only applied for Shared VPC.
+        See [Shared VPC documentation](https://cloud.google.com/vpc/docs/shared-vpc/).
+        """,
+    )
+
+  def Collection(self):
+    return 'compute.subnetworks'
+
+  def GetUriFunc(self):
+    def _GetUri(search_result):
+      return ''.join([
+          p.value.string_value
+          for p
+          in search_result.resource.additionalProperties
+          if p.key == 'selfLink'])
+    return _GetUri
+
+  def Run(self, args):
+    holder = base_classes.ComputeApiHolder(self.ReleaseTrack())
+    client = holder.client
+    messages = holder.client.messages
+    request = messages.ComputeSubnetworksListUsableRequest(
+        project=properties.VALUES.core.project.Get(required=True))
+
+    if args.service_project:
+      request.serviceProject = args.service_project
+
+    return list_pager.YieldFromList(
+        client.apitools_client.subnetworks,
+        request,
+        method='ListUsable',
+        batch_size_attribute='maxResults',
+        batch_size=500,
+        field='items')

gcloud auth application-default login/google-cloud-sdk/lib/surface/compute/networks/subnets/remove_iam_policy_binding.yaml

@@ -0,0 +1,62 @@
+release_tracks: [GA, BETA, ALPHA]
+help_text:
+  brief: Remove an IAM policy binding from a Compute Engine subnetwork.
+  description: |
+    Remove an IAM policy binding from a Compute Engine subnetwork.
+
+  examples: |
+    To remove an IAM policy binding for the role of 'roles/compute.securityAdmin' for the user 'test-user@gmail.com'
+    with subnetwork 'my-subnet' and region 'REGION', run:
+
+      $ {command} my-subnet --region=REGION --member='user:test-user@gmail.com' --role='roles/compute.securityAdmin'
+
+    See https://cloud.google.com/iam/docs/managing-policies for details of
+    policy role and member types.
+
+request:
+  collection: compute.subnetworks
+  use_relative_name: false
+  api_version: v1
+  BETA:
+    api_version: beta
+  ALPHA:
+    api_version: alpha
+
+iam:
+  set_iam_policy_request_path: regionSetPolicyRequest
+  message_type_overrides:
+    policy: Policy
+    set_iam_policy_request: ComputeSubnetworksSetIamPolicyRequest
+  ALPHA:
+    enable_condition: true
+    policy_version: 3
+    get_iam_policy_version_path: optionsRequestedPolicyVersion
+  BETA:
+    policy_version: 3
+    get_iam_policy_version_path: optionsRequestedPolicyVersion
+
+arguments:
+  resource:
+    help_text: The subnetwork for which to remove the IAM policy from.
+    spec: !REF googlecloudsdk.command_lib.compute.resources:subnet
+
+ALPHA:
+  help_text:
+    brief: Remove IAM policy binding from a Compute Engine subnetwork.
+    description: |
+      Remove an IAM policy binding from the IAM policy of a Compute Engine subnetwork. One binding consists of a member,
+      a role, and an optional condition.
+
+    examples: |
+      To remove an IAM policy binding for the role of 'roles/compute.securityAdmin' for the user 'test-user@gmail.com'
+      with subnetwork 'my-subnet' and region 'REGION', run:
+
+        $ {command} my-subnet --region=REGION --member='user:test-user@gmail.com' --role='roles/compute.securityAdmin'
+
+      To remove an IAM policy binding which expires at the end of the year 2018 for the role of
+      'roles/compute.securityAdmin' and the user 'test-user@gmail.com' with subnetwork 'my-subnet' and region 'REGION', run:
+
+        $ {command} my-subnet --region=REGION --member='user:test-user@gmail.com' --role='roles/compute.securityAdmin' --condition='expression=request.time < timestamp("2019-01-01T00:00:00Z"),title=expires_end_of_2018,description=Expires at midnight on 2018-12-31'
+
+      See https://cloud.google.com/iam/docs/managing-policies for details of
+      policy role and member types.

gcloud auth application-default login/google-cloud-sdk/lib/surface/compute/networks/subnets/set_iam_policy.yaml

@@ -0,0 +1,37 @@
+release_tracks: [ALPHA, BETA, GA]
+
+help_text:
+  brief: Set the IAM policy for a Compute Engine subnetwork.
+  description: |
+    Sets the IAM policy for the given subnetwork as defined in a JSON or YAML file.
+
+  examples: |
+    The following command will read am IAM policy defined in a JSON file
+    'policy.json' and set it for the subnetwork `my-subnet`:
+
+      $ {command} my-subnet policy.json --region=REGION
+
+    See https://cloud.google.com/iam/docs/managing-policies for details of the
+    policy file format and contents.
+
+request:
+  collection: compute.subnetworks
+  use_relative_name: false
+  modify_request_hooks:
+  - googlecloudsdk.command_lib.iam.hooks:UseMaxRequestedPolicyVersion:api_field=regionSetPolicyRequest.policy.version
+  api_version: v1
+  BETA:
+    api_version: beta
+  ALPHA:
+    api_version: alpha
+
+iam:
+  set_iam_policy_request_path: regionSetPolicyRequest
+  message_type_overrides:
+    policy: Policy
+    set_iam_policy_request: ComputeSubnetworksSetIamPolicyRequest
+
+arguments:
+  resource:
+    help_text: The subnetwork to set the IAM policy for.
+    spec: !REF googlecloudsdk.command_lib.compute.resources:subnet

gcloud auth application-default login/google-cloud-sdk/lib/surface/compute/networks/subnets/update.py

@@ -0,0 +1,171 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2016 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command for modifying the properties of a subnetwork."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.compute import base_classes
+from googlecloudsdk.api_lib.compute import subnets_utils
+from googlecloudsdk.api_lib.compute import utils as compute_api
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.compute.networks.subnets import flags
+
+
+def _DetailedHelp():
+  return {
+      'brief':
+          'Updates properties of an existing Compute Engine subnetwork.',
+      'DESCRIPTION':
+          """\
+          *{command}* is used to update properties of an existing Compute Engine
+          subnetwork.
+      """,
+      'EXAMPLES':
+          """\
+        To enable external IPv6 addresses on the subnetwork example-subnet-1 in
+        network-1, run
+
+        $ {command} example-subnet-1 --stack-type=IPV4_IPV6 \
+--ipv6-access-type=EXTERNAL \
+--region=REGION
+      """
+  }
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class Update(base.UpdateCommand):
+  """Updates properties of an existing Compute Engine subnetwork."""
+
+  _include_alpha_logging = False
+  _include_allow_cidr_routes_overlap = False
+  _api_version = compute_api.COMPUTE_GA_API_VERSION
+  _update_purpose_to_private = True
+  detailed_help = _DetailedHelp()
+
+  @classmethod
+  def Args(cls, parser):
+    """The command arguments handler.
+
+    Args:
+      parser: An argparse.ArgumentParser instance.
+    """
+    cls.SUBNETWORK_ARG = flags.SubnetworkArgument()
+    cls.SUBNETWORK_ARG.AddArgument(parser, operation_type='update')
+
+    flags.IpCollectionArgument().AddArgument(parser, operation_type='update')
+
+    flags.AddUpdateArgs(
+        parser,
+        cls._include_alpha_logging,
+        cls._include_allow_cidr_routes_overlap,
+        cls._api_version,
+        cls._update_purpose_to_private,
+    )
+
+  def Run(self, args):
+    """Issues requests necessary to update Subnetworks."""
+    holder = base_classes.ComputeApiHolder(self.ReleaseTrack())
+    client = holder.client
+    subnet_ref = self.SUBNETWORK_ARG.ResolveAsResource(args, holder.resources)
+
+    aggregation_interval = args.logging_aggregation_interval
+    flow_sampling = args.logging_flow_sampling
+    metadata = args.logging_metadata
+    filter_expr = args.logging_filter_expr
+    metadata_fields = args.logging_metadata_fields
+
+    if self._include_alpha_logging:
+      if args.aggregation_interval is not None:
+        aggregation_interval = args.aggregation_interval
+      if args.flow_sampling is not None:
+        flow_sampling = args.flow_sampling
+      if args.metadata is not None:
+        metadata = args.metadata
+
+    set_role_active = None
+    drain_timeout_seconds = args.drain_timeout
+    if args.role is not None:
+      set_role_active = getattr(args, 'role', None) == 'ACTIVE'
+
+    set_new_purpose = None
+    if args.purpose is not None:
+      set_new_purpose = getattr(args, 'purpose', None)
+
+    private_ipv6_google_access_type = args.private_ipv6_google_access_type
+
+    allow_cidr_routes_overlap = None
+    if self._include_allow_cidr_routes_overlap:
+      allow_cidr_routes_overlap = args.allow_cidr_routes_overlap
+
+    stack_type = getattr(args, 'stack_type', None)
+    ipv6_access_type = getattr(args, 'ipv6_access_type', None)
+
+    reserved_internal_ranges = getattr(
+        args, 'add_secondary_ranges_with_reserved_internal_range', None)
+
+    external_ipv6_prefix = getattr(args, 'external_ipv6_prefix', None)
+    internal_ipv6_prefix = getattr(args, 'internal_ipv6_prefix', None)
+
+    ip_collection = None
+    if args.ip_collection:
+      ip_collection = flags.IpCollectionArgument().ResolveAsResource(
+          args, holder.resources
+      ).SelfLink()
+
+    return subnets_utils.MakeSubnetworkUpdateRequest(
+        client,
+        subnet_ref,
+        enable_private_ip_google_access=args.enable_private_ip_google_access,
+        add_secondary_ranges=args.add_secondary_ranges,
+        add_secondary_ranges_with_reserved_internal_range=reserved_internal_ranges,
+        remove_secondary_ranges=args.remove_secondary_ranges,
+        enable_flow_logs=args.enable_flow_logs,
+        aggregation_interval=aggregation_interval,
+        flow_sampling=flow_sampling,
+        metadata=metadata,
+        filter_expr=filter_expr,
+        metadata_fields=metadata_fields,
+        set_role_active=set_role_active,
+        set_new_purpose=set_new_purpose,
+        drain_timeout_seconds=drain_timeout_seconds,
+        private_ipv6_google_access_type=private_ipv6_google_access_type,
+        allow_cidr_routes_overlap=allow_cidr_routes_overlap,
+        stack_type=stack_type,
+        ipv6_access_type=ipv6_access_type,
+        external_ipv6_prefix=external_ipv6_prefix,
+        internal_ipv6_prefix=internal_ipv6_prefix,
+        ip_collection=ip_collection,
+    )
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+class UpdateBeta(Update):
+  """Updates properties of an existing Compute Engine subnetwork."""
+
+  _include_allow_cidr_routes_overlap = True
+  _api_version = compute_api.COMPUTE_BETA_API_VERSION
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class UpdateAlpha(UpdateBeta):
+  """Updates properties of an existing Compute Engine subnetwork."""
+
+  _include_alpha_logging = True
+  _include_allow_cidr_routes_overlap = True
+  _api_version = compute_api.COMPUTE_ALPHA_API_VERSION
+  _update_purpose_to_private = True