feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/__init__.py

@@ -0,0 +1,29 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2024 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The main command group for Managed Service for Apache Kafka."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(
+    base.ReleaseTrack.GA, base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA
+)
+class ApacheKafkaForBigQuery(base.Group):
+  """Administer Managed Service for Apache Kafka clusters, topics, and consumer groups."""
+  category = base.DATA_ANALYTICS_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/acls/__init__.py

@@ -0,0 +1,29 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Managed Service for Apache Kafka acls operations."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(
+    base.ReleaseTrack.GA, base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA
+)
+class Acls(base.Group):
+  """Administer Managed Service for Apache Kafka acls."""
+  category = base.DATA_ANALYTICS_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/acls/add_acl_entry.yaml

@@ -0,0 +1,55 @@
+release_tracks: [GA, ALPHA, BETA]
+
+help_text:
+  brief: |
+    Add an acl entry to a Managed Service for Apache Kafka acl.
+  description: |
+    Add an acl entry to a Managed Service for Apache Kafka acl.
+
+  examples: |
+    To add an acl entry for the Kafka cluster resource pattern (acl ID = cluster),
+    in a cluster named mycluster located in us-central1, run the following:
+
+      $ {command} cluster \
+          --cluster=mycluster \
+          --location=us-central1 \
+          --principal='User:admin@project.iam.gserviceaccount.com' --operation=ALL \
+          --permission-type=ALLOW --host='*'
+
+request:
+  collection: managedkafka.projects.locations.clusters.acls
+  method: addAclEntry
+
+arguments:
+  resource:
+    help_text: |
+      Identifies the acl that this command updates.
+
+      The structure of the acl ID defines the Resource Pattern for which the
+      acl entries apply in the Kafka cluster. The acl ID must be structured
+      like one of the following:
+
+        For acls on the cluster:
+          cluster
+
+        For acls on a single resource within the cluster:
+          topic/{resource_name}
+          consumerGroup/{resource_name}
+          transactionalId/{resource_name}
+
+        For acls on all resources that match a prefix:
+          topicPrefixed/{resource_name}
+          consumerGroupPrefixed/{resource_name}
+          transactionalIdPrefixed/{resource_name}
+
+        For acls on all resources of a given type (i.e. the wildcard literal "*"):
+          allTopics (represents topic/*)
+          allConsumerGroups (represents consumerGroup/*)
+          allTransactionalIds (represents transactionalId/*)
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:acl
+
+  params:
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:acl-entry-principal
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:acl-entry-operation
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:acl-entry-permission-type
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:acl-entry-host

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/acls/create.yaml

@@ -0,0 +1,63 @@
+release_tracks: [GA, ALPHA, BETA]
+
+help_text:
+  brief: |
+    Create a Managed Service for Apache Kafka acl.
+  description: |
+    Create a Managed Service for Apache Kafka acl.
+
+  examples: |
+    To create an acl for the Kafka cluster resource pattern (acl ID = cluster),
+    in a cluster named mycluster located in us-central1, run the following:
+
+        $ {command} cluster \
+            --cluster=mycluster --location=us-central1 \
+            --acl-entry=principal='User:admin@project.iam.gserviceaccount.com',\
+              operation=ALL,permission-type=ALLOW,host='*'
+            --acl-entry=principal='User:reader@project.iam.gserviceaccount.com',\
+              operation=DESCRIBE,permission-type=ALLOW,host='*'
+            --acl-entry=principal='User:reader@project.iam.gserviceaccount.com',\
+              operation=DESCRIBE_CONFIGS,permission-type=ALLOW,host='*'
+
+    This acl grants an "admin" service account access to ALL cluster-level
+    operations, and grants a "reader" service account access to cluster-level
+    DESCRIBE and DESCRIBE_CONFIGS operations.
+
+request:
+  collection: managedkafka.projects.locations.clusters.acls
+
+arguments:
+  resource:
+    help_text: |
+      Identifies the name of the acl that this command creates.
+
+      The structure of the acl ID defines the Resource Pattern for which the
+      acl entries apply in the Kafka cluster. The acl ID must be structured
+      like one of the following:
+
+        For acls on the cluster:
+          cluster
+
+        For acls on a single resource within the cluster:
+          topic/{resource_name}
+          consumerGroup/{resource_name}
+          transactionalId/{resource_name}
+
+        For acls on all resources that match a prefix:
+          topicPrefixed/{resource_name}
+          consumerGroupPrefixed/{resource_name}
+          transactionalIdPrefixed/{resource_name}
+
+        For acls on all resources of a given type (i.e. the wildcard literal "*"):
+          allTopics (represents topic/*)
+          allConsumerGroups (represents consumerGroup/*)
+          allTransactionalIds (represents transactionalId/*)
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:acl
+
+  params:
+  - group:
+      mutex: true
+      required: true
+      params:
+      - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:acl-entry
+      - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:acl-entries-from-file

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/acls/delete.yaml

@@ -0,0 +1,47 @@
+release_tracks: [GA, ALPHA, BETA]
+
+help_text:
+  brief: |
+    Delete a Managed Service for Apache Kafka ACL.
+
+  description: |
+    Delete a Managed Service for Apache Kafka ACL.
+
+  examples: |
+    To delete an acl for all topics, in a cluster named mycluster located in us-central1,
+    run the following:
+
+      $ {command} allTopics \
+          --cluster=mycluster \
+          --location=us-central1
+
+request:
+  collection: managedkafka.projects.locations.clusters.acls
+
+arguments:
+  resource:
+    help_text: |
+      Identifies the acl for deletion.
+
+      The structure of the acl ID defines the Resource Pattern for which the
+      acl entries apply in the Kafka cluster. The acl ID must be structured
+      like one of the following:
+
+        For acls on the cluster:
+          cluster
+
+        For acls on a single resource within the cluster:
+          topic/{resource_name}
+          consumerGroup/{resource_name}
+          transactionalId/{resource_name}
+
+        For acls on all resources that match a prefix:
+          topicPrefixed/{resource_name}
+          consumerGroupPrefixed/{resource_name}
+          transactionalIdPrefixed/{resource_name}
+
+        For acls on all resources of a given type (i.e. the wildcard literal "*"):
+          allTopics (represents topic/*)
+          allConsumerGroups (represents consumerGroup/*)
+          allTransactionalIds (represents transactionalId/*)
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:acl

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/acls/describe.yaml

@@ -0,0 +1,23 @@
+release_tracks: [GA, ALPHA, BETA]
+
+help_text:
+  brief: |
+    Describe a Managed Service for Apache Kafka acl.
+  description: |
+    Describe a Managed Service for Apache Kafka acl.
+
+  examples: |
+    To describe an acl for the consumer group mygroup, in a cluster named mycluster located in
+    us-central1, run the following:
+
+      $ {command} consumerGroup/mygroup \
+          --cluster=mycluster \
+          --location=us-central1
+
+request:
+  collection: managedkafka.projects.locations.clusters.acls
+
+arguments:
+  resource:
+    help_text: The describe command displays properties of the acl specified by this parameter.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:acl

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/acls/list.yaml

@@ -0,0 +1,25 @@
+release_tracks: [GA, ALPHA, BETA]
+
+help_text:
+  brief: |
+    List all Managed Service for Apache Kafka acls in a given cluster.
+
+  description: |
+    List all Managed Service for Apache Kafka acls in a given cluster.
+    To specify the maximum number of acls to list, use the --limit flag.
+
+  examples: |
+    To list acls in a cluster named mycluster located in us-central1,
+    run the following:
+
+      $ {command} mycluster
+          --location=us-central1
+
+request:
+  collection: managedkafka.projects.locations.clusters.acls
+
+arguments:
+  resource:
+    is_positional: true
+    help_text: Identifies the cluster which contains all the acls to be listed.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:cluster

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/acls/remove_acl_entry.yaml

@@ -0,0 +1,32 @@
+release_tracks: [GA, ALPHA, BETA]
+
+help_text:
+  brief: |
+    Remove an acl entry from a Managed Service for Apache Kafka acl.
+  description: |
+    Remove an acl entry from a Managed Service for Apache Kafka acl.
+
+  examples: |
+    To remove an acl entry for the Kafka cluster resource pattern (acl_id=cluster),
+    in a cluster named `mycluster` located in `us-central1`, run the following:
+
+      $ {command} cluster \
+          --cluster=mycluster \
+          --location=us-central1 \
+          --principal='User:admin@project.iam.gserviceaccount.com' --operation=ALL \
+          --permission-type=ALLOW --host='*'
+
+request:
+  collection: managedkafka.projects.locations.clusters.acls
+  method: removeAclEntry
+
+arguments:
+  resource:
+    help_text: Identifies the name of the acl that this command updates.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:acl
+
+  params:
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:acl-entry-principal
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:acl-entry-operation
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:acl-entry-permission-type
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:acl-entry-host

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/acls/update.yaml

@@ -0,0 +1,42 @@
+release_tracks: [GA, ALPHA, BETA]
+
+help_text:
+  brief: |
+    Update a Managed Service for Apache Kafka acl.
+  description: |
+    Update a Managed Service for Apache Kafka acl.
+
+    NOTE: update performs a FULL REPLACEMENT of acl entries. For incremental
+    updates, use add-acl-entry and remove-acl-entry commands.
+
+  examples: |
+    To update an acl for the Kafka cluster resource pattern, with etag W/XYZ123
+    returned from a previous create or describe command, in a cluster named
+    mycluster located in us-central1, run the following:
+
+      $ {command} cluster \
+          --cluster=mycluster \
+          --location=us-central1 \
+          --acl-entry=principal='User:admin@project.iam.gserviceaccount.com',operation=ALL,permission-type=ALLOW,host='*' \
+          --etag=W/XYZ123
+
+request:
+  collection: managedkafka.projects.locations.clusters.acls
+
+arguments:
+  resource:
+    help_text: Identifies the name of the acl that this command updates.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:acl
+
+  params:
+  - group:
+      mutex: true
+      required: true
+      params:
+      - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:acl-entry
+      - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:acl-entries-from-file
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:etag
+
+input:
+  confirmation_prompt: |-
+    WARNING: This update will replace all existing ACL entries. Any entries not included in this update will be deleted.

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/clusters/__init__.py

@@ -0,0 +1,29 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2024 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Managed Service for Apache Kafka clusters operations."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(
+    base.ReleaseTrack.GA, base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA
+)
+class Clusters(base.Group):
+  """Administer Managed Service for Apache Kafka clusters."""
+  category = base.DATA_ANALYTICS_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/clusters/create.yaml

@@ -0,0 +1,45 @@
+release_tracks: [GA, ALPHA, BETA]
+
+help_text:
+  brief: |
+    Create a Managed Service for Apache Kafka cluster.
+  description: |
+    Create a Managed Service for Apache Kafka cluster.
+
+  examples: |
+    To create a cluster, run the following:
+
+      $ {command} mycluster \
+          --location=us-central1 \
+          --cpu=3 \
+          --memory=3GiB
+          --subnets=projects/PROJECT_ID/regions/us-central1/subnetworks/default
+
+request:
+  collection: managedkafka.projects.locations.clusters
+  modify_request_hooks:
+  - googlecloudsdk.command_lib.managed_kafka.util:MapSubnetsToNetworkConfig
+  - googlecloudsdk.command_lib.managed_kafka.util:MapCaPoolsToCASConfig
+
+async:
+  collection: managedkafka.projects.locations.operations
+
+arguments:
+  resource:
+    help_text: Identifies the cluster for which the command runs.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:cluster
+  params:
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:cpu
+    required: true
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:memory
+    required: true
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:subnets
+    required: true
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:labels
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:encryption-key
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:auto-rebalance
+    default: true
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:mtls-ca-pools
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:ssl-principal-mapping-rules
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:broker-disk-size-gib
+    release_tracks: [ALPHA]

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/clusters/delete.yaml

@@ -0,0 +1,25 @@
+release_tracks: [GA, ALPHA, BETA]
+
+help_text:
+  brief: |
+    Delete a Managed Service for Apache Kafka cluster.
+  description: |
+    Delete a Managed Service for Apache Kafka cluster.
+
+  examples: |
+    To delete a cluster named mycluster located in us-central1,
+    run the following:
+
+      $ {command} mycluster \
+          --location=us-central1
+
+request:
+  collection: managedkafka.projects.locations.clusters
+
+arguments:
+  resource:
+    help_text: Identifies the cluster for deletion.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:cluster
+
+async:
+  collection: managedkafka.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/clusters/describe.yaml

@@ -0,0 +1,28 @@
+release_tracks: [GA, ALPHA, BETA]
+
+help_text:
+  brief: |
+    Describe a Managed Service for Apache Kafka cluster.
+  description: |
+    Describe a Managed Service for Apache Kafka cluster.
+
+  examples: |
+    To describe a cluster named mycluster located in us-central1,
+    run the following:
+
+      $ {command} mycluster \
+          --location=us-central1
+
+request:
+  collection: managedkafka.projects.locations.clusters
+
+arguments:
+  resource:
+    help_text: Identifies the cluster for details to be displayed.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:cluster
+  params:
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:full
+
+response:
+  modify_response_hooks:
+  - googlecloudsdk.command_lib.managed_kafka.util:DescribeWithBootstrapAddr

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/clusters/list.yaml

@@ -0,0 +1,38 @@
+release_tracks: [GA, ALPHA, BETA]
+
+help_text:
+  brief: |
+    List all Managed Service for Apache Kafka clusters in a given location.
+  description: |
+    List all Apache Kafka for BigQuery clusters in a given location.
+    To specify the maximum number of clusters to list, use the --limit flag.
+
+  examples: |
+    To list all clusters in a given location, such as us-central1, run the following:
+
+      $ {command} --location=us-central1
+
+request:
+  collection: managedkafka.projects.locations.clusters
+
+arguments:
+  resource:
+    help_text: |
+      Identifies the region which contains all the clusters to be listed.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:location
+
+response:
+  modify_response_hooks:
+  - googlecloudsdk.command_lib.managed_kafka.util:ListWithBootstrapAddr
+
+output:
+  format: |
+    table[box](
+      name.segment(5):label=NAME,
+      bootstrapAddress:label=BOOTSTRAP,
+      capacityConfig.vcpuCount:label=VCPU,
+      capacityConfig.memoryBytes:label=MEMORY_BYTES,
+      state:label=STATE,
+      gcpConfig.accessConfig.networkConfigs.subnet.list(separator="
+    "):label=NETWORK
+    )

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/clusters/update.yaml

@@ -0,0 +1,49 @@
+release_tracks: [GA, ALPHA, BETA]
+
+help_text:
+  brief: |
+    Update a Managed Service for Apache Kafka cluster.
+
+  description: |
+    Update a Managed Service for Apache Kafka cluster.
+
+  examples: |
+    To update an attribute in a cluster named mycluster located in us-central1,
+    such as the CPU, run the following:
+
+      $ {command} mycluster \
+          --location=us-central1 \
+          --cpu=3
+
+request:
+  collection: managedkafka.projects.locations.clusters
+  modify_request_hooks:
+  - googlecloudsdk.command_lib.managed_kafka.util:PrepareUpdateWithSubnets
+  - googlecloudsdk.command_lib.managed_kafka.util:PrepareUpdateWithCaPools
+
+arguments:
+  resource:
+    help_text: Identifies the cluster to be updated.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:cluster
+  params:
+  - group:
+      required: true
+      params:
+      - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:cpu
+      - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:memory
+      - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:subnets
+      - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:labels
+      - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:auto-rebalance
+        default: null
+      - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:ssl-principal-mapping-rules
+      - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:broker-disk-size-gib
+        release_tracks: [ALPHA]
+      - group:
+          mutex: true
+          params:
+          - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:mtls-ca-pools
+          - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:clear-mtls-ca-pools
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:allow-broker-downscale-on-cluster-upscale
+
+async:
+  collection: managedkafka.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/connect_clusters/__init__.py

@@ -0,0 +1,29 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Managed Service for Apache Kafka connect-clusters operations."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+class ConnectClusters(base.Group):
+  """Administer Managed Service for Apache Kafka connect-clusters."""
+
+  category = base.DATA_ANALYTICS_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/connect_clusters/create.yaml

@@ -0,0 +1,49 @@
+release_tracks: [ALPHA, BETA, GA]
+
+help_text:
+  brief: |
+    Create a Managed Service for Apache Kafka connect cluster.
+  description: |
+    Create a Managed Service for Apache Kafka connect cluster.
+
+  examples: |
+    To create a connector cluster, run the following:
+
+      $ {command} myconnectorCluster \
+          --location=us-central1 \
+          --cpu=3 \
+          --memory=3GiB \
+          --primary-subnet=projects/PROJECT_ID/regions/us-central1/subnetworks/default
+          --kafka-cluster=my-kafka-cluster OR --kafka-cluster=projects/PROJECT_ID/locations/us-central1/clusters/my-kafka-cluster
+
+request:
+  collection: managedkafka.projects.locations.connectClusters
+  modify_request_hooks:
+  - googlecloudsdk.command_lib.managed_kafka.util:PrepareConnectClusterCreate
+  - googlecloudsdk.command_lib.managed_kafka.util:MapConnectParamsToNetworkConfig
+
+async:
+  collection: managedkafka.projects.locations.operations
+
+arguments:
+  resource:
+    help_text: Identifies the connect cluster that is created.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:connect_cluster
+  params:
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:kafka-cluster
+    required: true
+  - group:
+      mutex: true
+      params:
+      - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:connectCluster-configs
+      - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:connectCluster-config-file
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:connect-cpu
+    required: true
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:connect-memory
+    required: true
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:connect-primary-subnet
+    required: true
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:connect-additional-subnet
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:dns-name
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:secret
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:connect-labels

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/connect_clusters/delete.yaml

@@ -0,0 +1,25 @@
+release_tracks: [ALPHA, BETA, GA]
+
+help_text:
+  brief: |
+    Delete a Managed Service for Apache Kafka connect cluster.
+  description: |
+    Delete a Managed Service for Apache Kafka connect cluster.
+
+  examples: |
+    To delete a connect cluster named myconnectcluster located in us-central1,
+    run the following:
+
+      $ {command} myconnectcluster \
+          --location=us-central1
+
+request:
+  collection: managedkafka.projects.locations.connectClusters
+
+arguments:
+  resource:
+    help_text: Identifies the connect cluster for deletion.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:connect_cluster
+
+async:
+  collection: managedkafka.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/connect_clusters/describe.yaml

@@ -0,0 +1,22 @@
+release_tracks: [ALPHA, BETA, GA]
+
+help_text:
+  brief: |
+    Describe a Managed Service for Apache Kafka connect cluster.
+  description: |
+    Describe a Managed Service for Apache Kafka for BigQuery connect cluster.
+
+  examples: |
+    To describe a connect cluster named myconnectcluster located in us-central1,
+    run the following:
+
+      $ {command} myconnectcluster \
+          --location=us-central1
+
+request:
+  collection: managedkafka.projects.locations.connectClusters
+
+arguments:
+  resource:
+    help_text: Identifies the connect cluster.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:connect_cluster

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/connect_clusters/list.yaml

@@ -0,0 +1,31 @@
+release_tracks: [ALPHA, BETA, GA]
+
+help_text:
+  brief: |
+    List all Managed Service for Apache Kafka connect clusters in a given location.
+  description: |
+    List all Managed Service for Apache Kafka connect clusters in a given location.
+    To specify the maximum number of clusters to list, use the --limit flag.
+
+  examples: |
+    To list all connect clusters in a given location, such as us-central1, run the following:
+
+      $ {command} --location=us-central1
+
+request:
+  collection: managedkafka.projects.locations.connectClusters
+
+arguments:
+  resource:
+    help_text: Identifies the region which contains all the connector clusters to be listed.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:location
+
+output:
+  format: |
+    table[box](
+      name.segment(5):label=NAME,
+      capacityConfig.vcpuCount:label=VCPU,
+      capacityConfig.memoryBytes:label=MEMORY_BYTES,
+      state:label=STATE,
+      gcpConfig.accessConfig.networkConfigs.primarySubnet:label=PRIMARY_SUBNET
+    )

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/connect_clusters/update.yaml

@@ -0,0 +1,71 @@
+release_tracks: [ALPHA, BETA, GA]
+
+help_text:
+  brief: |
+    Update a Managed Service for Apache Kafka for BigQuery connect cluster.
+  description: |
+    Update an Managed Service for Apache Kafka for BigQuery connect cluster.
+
+  examples: |
+    To update a connect cluster, run the following:
+
+      $ {command} myconnectorCluster \
+          --location=us-central1 \
+          --configs=KEY1=VALUE1,KEY2=VALUE2... OR --config-file=my-config-file.yaml \
+          --cpu=3 \
+          --memory=3GiB \
+          --primary-subnet=projects/my-project/regions/us-central1/subnetworks/default/1 \
+          --dns-name=bootstrap.myconnectorCluster.us-central1.managedkafka.my-project.cloud.goog:9092 \
+          --secret=projects/my-project/secrets/my-secret/versions/1 \
+          --labels=KEY1=VALUE1,KEY2=VALUE2...
+
+request:
+  collection: managedkafka.projects.locations.connectClusters
+  modify_request_hooks:
+  - googlecloudsdk.command_lib.managed_kafka.util:PrepareConnectClusterUpdate
+  - googlecloudsdk.command_lib.managed_kafka.util:MapConnectParamsToNetworkConfig
+
+async:
+  collection: managedkafka.projects.locations.operations
+
+arguments:
+  resource:
+    help_text: Identifies the connect cluster for which the command runs.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:connect_cluster
+  params:
+  - group:
+      required: true
+      params:
+      - group:
+          mutex: true
+          params:
+          - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:connectCluster-configs
+          - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:connectCluster-config-file
+          - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:clear-configs
+      - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:connect-cpu
+      - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:connect-memory
+      # Require primary subnet to be provided iff additional subnet is provided.
+      - group:
+          mutex: true
+          required: false
+          params:
+          - group:
+              params:
+              - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:connect-primary-subnet
+                required: true
+              - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:connect-additional-subnet
+      - group:
+          mutex: true
+          params:
+          - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:dns-name
+          - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:clear-dns-names
+      - group:
+          mutex: true
+          params:
+          - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:secret
+          - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:clear-secrets
+      - group:
+          mutex: true
+          params:
+          - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:connect-labels
+          - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:clear-connect-labels

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/connectors/__init__.py

@@ -0,0 +1,29 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Managed Service for Apache Kafka connectors operations."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+class Connectors(base.Group):
+  """Administer Managed Service for Apache Kafka connectors."""
+
+  category = base.DATA_ANALYTICS_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/connectors/create.yaml

@@ -0,0 +1,53 @@
+release_tracks: [ALPHA, BETA, GA]
+
+help_text:
+  brief: |
+    Create a Managed Service for Apache Kafka connector.
+  description: |
+    Create a Managed Service for Apache Kafka connector.
+
+  examples: |
+    To create a connector, run the following:
+
+      $ {command} myconnector \
+          --location=us-central1 \
+          --connect-cluster=mycluster \
+          --configs=connector.class="com.google.pubsub.kafka.source.CloudPubSubSourceConnector",cps.subscription="my-subscription",... \
+          [--task-restart-min-backoff=60s] \
+          [--task-restart-max-backoff=30m] \
+          [--task-retry-disabled=true]
+      OR
+      $ {command} myconnector \
+          --location=us-central1 \
+          --connect-cluster=mycluster \
+          --config-file=my-config-file.yaml \
+          [--task-restart-min-backoff=60s] \
+          [--task-restart-max-backoff=30m] \
+          [--task-retry-disabled=true]
+
+request:
+  collection: managedkafka.projects.locations.connectClusters.connectors
+  modify_request_hooks:
+  - googlecloudsdk.command_lib.managed_kafka.util:ConnectorCreateReadConfigAndTaskRestartPolicy
+
+arguments:
+  resource:
+    help_text: Identifies the connector for which the command runs.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:connector
+    is_positional: true
+  params:
+  - group:
+      required: true
+      mutex: true
+      params:
+      - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:connector-configs
+      - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:connector-config-file
+  - group:
+      required: false
+      params:
+      - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:task-restart-min-backoff
+        required: true
+      - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:task-restart-max-backoff
+        required: true
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:task-retry-disabled
+    required: false

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/connectors/delete.yaml

@@ -0,0 +1,24 @@
+release_tracks: [ALPHA, BETA, GA]
+
+help_text:
+  brief: |
+    Delete a Managed Service for Apache Kafka connector.
+  description: |
+    Delete a Managed Service for Apache Kafka connector.
+
+  examples: |
+    To delete a connector named myconnector located in us-central1,
+    run the following:
+
+      $ {command} myconnector \
+          --location=us-central1 \
+          --connect-cluster=mycluster
+
+request:
+  collection: managedkafka.projects.locations.connectClusters.connectors
+
+arguments:
+  resource:
+    help_text: Identifies the cluster for deletion.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:connector
+    is_positional: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/connectors/describe.yaml

@@ -0,0 +1,24 @@
+release_tracks: [ALPHA, BETA, GA]
+
+help_text:
+  brief: |
+    Describe a Managed Service for Apache Kafka connector.
+  description: |
+    Describe a Managed Service for Apache Kafka connector.
+
+  examples: |
+    To describe a connector named myconnector located in us-central1,
+    run the following:
+
+      $ {command} myconnector \
+          --location=us-central1 \
+          --connect-cluster=mycluster
+
+request:
+  collection: managedkafka.projects.locations.connectClusters.connectors
+
+arguments:
+  resource:
+    help_text: Identifies the connector for details to be displayed.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:connector
+    is_positional: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/connectors/list.yaml

@@ -0,0 +1,30 @@
+release_tracks: [ALPHA, BETA, GA]
+
+help_text:
+  brief: |
+    List all Managed Service for Apache Kafka connectors for a given connect cluster.
+  description: |
+    List all Managed Service for Apache Kafka connectors for a given connect cluster.
+    To specify the maximum number of connectors to list, use the --limit flag.
+
+  examples: |
+    To list all Managed Service for Apache Kafka connectors belonging to the "mycluster" connect cluster in us-central1, run the following:
+
+      $ {command} mycluster --location=us-central1
+
+request:
+  collection: managedkafka.projects.locations.connectClusters.connectors
+
+arguments:
+  resource:
+    help_text: Identifies the cluster which contains all the connectors to be listed.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:connect_cluster
+    is_positional: true
+
+output:
+  format: |
+    table[box](
+      name.segment(7):label=NAME,
+      configs."connector.class":label=CLASS,
+      state:label=STATE
+    )

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/connectors/pause.yaml

@@ -0,0 +1,25 @@
+release_tracks: [ALPHA, BETA, GA]
+
+help_text:
+  brief: |
+    Pauses operation of a Managed Service for Apache Kafka connector.
+  description: |
+    Pauses operation of a Managed Service for Apache Kafka connector.
+
+  examples: |
+    To pause a connector named myconnector located in us-central1,
+    run the following:
+
+      $ {command} myconnector \
+          --location=us-central1 \
+          --connect-cluster=mycluster
+
+request:
+  collection: managedkafka.projects.locations.connectClusters.connectors
+  method: pause
+
+arguments:
+  resource:
+    help_text: Identifies the connector to pause.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:connector
+    is_positional: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/connectors/restart.yaml

@@ -0,0 +1,25 @@
+release_tracks: [ALPHA, BETA, GA]
+
+help_text:
+  brief: |
+    Restarts a Managed Service for Apache Kafka connector.
+  description: |
+    Restarts a Managed Service for Apache Kafka connector.
+
+  examples: |
+    To restart a connector named myconnector located in us-central1,
+    run the following:
+
+      $ {command} myconnector \
+          --location=us-central1 \
+          --connect-cluster=mycluster
+
+request:
+  collection: managedkafka.projects.locations.connectClusters.connectors
+  method: restart
+
+arguments:
+  resource:
+    help_text: Identifies the connector to restart.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:connector
+    is_positional: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/connectors/resume.yaml

@@ -0,0 +1,25 @@
+release_tracks: [ALPHA, BETA, GA]
+
+help_text:
+  brief: |
+    Resumes operation of a stopped Managed Service for Apache Kafka connector.
+  description: |
+    Resumes operation of a stopped Managed Service for Apache Kafka connector.
+
+  examples: |
+    To resume a connector named myconnector located in us-central1,
+    run the following:
+
+      $ {command} myconnector \
+          --location=us-central1 \
+          --connect-cluster=mycluster
+
+request:
+  collection: managedkafka.projects.locations.connectClusters.connectors
+  method: resume
+
+arguments:
+  resource:
+    help_text: Identifies the connector to resume.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:connector
+    is_positional: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/connectors/stop.yaml

@@ -0,0 +1,25 @@
+release_tracks: [ALPHA, BETA, GA]
+
+help_text:
+  brief: |
+    Stops operation of a Managed Service for Apache Kafka connector.
+  description: |
+    Stops operation of a Managed Service for Apache Kafka connector.
+
+  examples: |
+    To stop a connector named myconnector located in us-central1,
+    run the following:
+
+      $ {command} myconnector \
+          --location=us-central1 \
+          --connect-cluster=mycluster
+
+request:
+  collection: managedkafka.projects.locations.connectClusters.connectors
+  method: stop
+
+arguments:
+  resource:
+    help_text: Identifies the connector to resume.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:connector
+    is_positional: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/connectors/update.yaml

@@ -0,0 +1,53 @@
+release_tracks: [ALPHA, BETA, GA]
+
+help_text:
+  brief: |
+    Update a Managed Service for Apache Kafka connector.
+  description: |
+    Update a Managed Service for Apache Kafka connector.
+
+  examples: |
+    To update a connector name myconnector, run the following:
+
+      $ {command} myconnector \
+          --location=us-central1 \
+          --configs=KEY1=VALUE1,KEY2=VALUE2... \
+          --connect-cluster=mycluster \
+          [--task-restart-min-backoff=60s] \
+          [--task-restart-max-backoff=30m] \
+          [--task-retry-disabled=true]
+      OR
+      $ {command} myconnector \
+          --location=us-central1 \
+          --config-file=my-config-file.yaml \
+          --connect-cluster=mycluster \
+          [--task-restart-min-backoff=60s] \
+          [--task-restart-max-backoff=30m] \
+          [--task-retry-disabled=true]
+
+request:
+  collection: managedkafka.projects.locations.connectClusters.connectors
+  modify_request_hooks:
+  - googlecloudsdk.command_lib.managed_kafka.util:ConnectorUpdateReadConfigAndTaskRestartPolicy
+
+arguments:
+  resource:
+    help_text: Identifies the connector for which the command runs.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:connector
+    is_positional: true
+  params:
+  - group:
+      mutex: true
+      params:
+      - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:connector-configs
+      - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:connector-config-file
+  # If one of the task restart flags is provided, both must be provided.
+  - group:
+      required: false
+      params:
+      - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:task-restart-min-backoff
+        required: true
+      - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:task-restart-max-backoff
+        required: true
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:task-retry-disabled
+    required: false

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/consumer_groups/__init__.py

@@ -0,0 +1,29 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2024 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Managed Service for Apache Kafka consumer groups operations."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(
+    base.ReleaseTrack.GA, base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA
+)
+class ConsumerGroups(base.Group):
+  """Administer Managed Service for Apache Kafka consumer groups."""
+  category = base.DATA_ANALYTICS_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/consumer_groups/delete.yaml

@@ -0,0 +1,23 @@
+release_tracks: [GA, ALPHA, BETA]
+
+help_text:
+  brief: |
+    Delete a Managed Service for Apache Kafka consumer group.
+  description: |
+    Delete a Managed Service for Apache Kafka consumer group.
+
+  examples: |
+    To delete a consumer group in a cluster named mycluster located in us-central1,
+    run the following:
+
+      $ {command} myconsumergroup \
+          --cluster=mycluster \
+          --location=us-central1
+
+request:
+  collection: managedkafka.projects.locations.clusters.consumerGroups
+
+arguments:
+  resource:
+    help_text: Identifies the consumer group for deletion.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:consumer_group

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/consumer_groups/describe.yaml

@@ -0,0 +1,23 @@
+release_tracks: [GA, ALPHA, BETA]
+
+help_text:
+  brief: |
+    Describe a Managed Service for Apache Kafka consumer group.
+  description: |
+    Describe a Managed Service for Apache Kafka consumer group.
+
+  examples: |
+    To describe a consumer group in a cluster named mycluster located in us-central1,
+    run the following:
+
+      $ {command} myconsumergroup \
+          --cluster=mycluster \
+          --location=us-central1
+
+request:
+  collection: managedkafka.projects.locations.clusters.consumerGroups
+
+arguments:
+  resource:
+    help_text: Identifies the consumer group for details to be displayed.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:consumer_group

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/consumer_groups/list.yaml

@@ -0,0 +1,25 @@
+release_tracks: [GA, ALPHA, BETA]
+
+help_text:
+  brief: |
+   List all Managed Service for Apache Kafka consumer groups in a given cluster and location.
+
+  description: |
+    List all Managed Service for Apache Kafka consumer groups in a given cluster and location.
+    To specify the maximum number of consumer groups to list, use the --limit flag.
+
+  examples: |
+    To list all consumer groups in a cluster named mycluster located in us-central1,
+    run the following:
+
+      $ {command} mycluster
+          --location=us-central1
+
+request:
+  collection: managedkafka.projects.locations.clusters.consumerGroups
+
+arguments:
+  resource:
+    is_positional: true
+    help_text: Identifies the cluster which contains all the consumer groups to be listed.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:cluster

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/consumer_groups/update.yaml

@@ -0,0 +1,37 @@
+release_tracks: [GA, ALPHA, BETA]
+
+help_text:
+  brief: |
+    Update a Managed Service for Apache Kafka consumer group.
+  description: |
+    Update a Managed Service for Apache Kafka consumer group.
+
+  examples: |
+    To specify a file for updating the topics of a consumer group,
+    run the following:
+
+      ${command} myconsumergroup |
+          --cluster=mycluster \
+          --location=us-central1 \
+          --topics-file=topics.json
+
+    To update the topics of a consumer group with inline JSON,
+    run the following:
+
+      ${command} myconsumergroup |
+          --cluster=mycluster \
+          --location=us-central1 \
+          --topics-file='{"topic":{"partitions":{"0":{"offset":1,"metadata":"metadata"}}}}'
+
+request:
+  collection: managedkafka.projects.locations.clusters.consumerGroups
+  modify_request_hooks:
+  - googlecloudsdk.command_lib.managed_kafka.util:UpdateTopics
+
+arguments:
+  resource:
+    help_text: Identifies the consumer group to be updated.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:consumer_group
+  params:
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:topics-file
+    required: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/operations/__init__.py

@@ -0,0 +1,29 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Managed Service for Apache Kafka long-running operations."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(
+    base.ReleaseTrack.GA, base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA
+)
+class Operations(base.Group):
+  """View Managed Service for Apache Kafka operations."""
+  category = base.DATA_ANALYTICS_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/operations/describe.yaml

@@ -0,0 +1,22 @@
+release_tracks: [GA, ALPHA, BETA]
+
+help_text:
+  brief: |
+    Describe a Managed Service for Apache Kafka operation.
+  description: |
+    Describe a Managed Service for Apache Kafka operation.
+
+  examples: |
+    To describe an operation named myoperation located in us-central1,
+    run the following:
+
+      $ {command} myoperation \
+          --location=us-central1
+
+request:
+  collection: managedkafka.projects.locations.operations
+
+arguments:
+  resource:
+    help_text: Identifies the operation for details to be displayed.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:operation

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/operations/list.yaml

@@ -0,0 +1,33 @@
+release_tracks: [GA, ALPHA, BETA]
+
+help_text:
+  brief: |
+    List all Managed Service for Apache Kafka operations in a given location.
+  description: |
+    List all Managed Service for Apache Kafka operations in a given location.
+    To specify the maximum number of operations to list, use the --limit flag.
+
+  examples: |
+    To list all clusters in a given location, such as us-central1, run the following:
+
+      $ {command} --location=us-central1
+
+request:
+  collection: managedkafka.projects.locations.operations
+
+arguments:
+  resource:
+    help_text: |
+      Identifies the region which contains all the operations to be listed.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:location
+
+output:
+  format: |
+    table[box](
+      name.segment(5):label=NAME,
+      metadata.target.split('/').slice(4:).join('/'):label=RESOURCE,
+      metadata.verb:label=VERB,
+      done,
+      metadata.createTime:label=CREATED:sort=1,
+      metadata.endTime:label=ENDED
+    )

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/schema_registries/__init__.py

@@ -0,0 +1,28 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Managed Service for Apache Kafka schema-registries operations."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA)
+class SchemaRegistries(base.Group):
+  """Administer Managed Service for Apache Kafka schema-registries."""
+
+  category = base.DATA_ANALYTICS_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/schema_registries/create.yaml

@@ -0,0 +1,21 @@
+release_tracks: [ALPHA, BETA]
+
+help_text:
+  brief: |
+    Create a Managed Service for Apache Kafka schema registry.
+  description: |
+    Create a Managed Service for Apache Kafka schema registry.
+
+  examples: |
+    To create a schema registry, run the following:
+
+      $ {command} myschemaregistry \
+          --location=us-central1
+
+request:
+  collection: managedkafka.projects.locations.schemaRegistries
+
+arguments:
+  resource:
+    help_text: Identifies the schema registry for which the command runs.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:schema_registry

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/schema_registries/delete.yaml

@@ -0,0 +1,22 @@
+release_tracks: [ALPHA, BETA]
+
+help_text:
+  brief: |
+    Delete a Managed Service for Apache Kafka schema registry.
+  description: |
+    Delete a Managed Service for Apache Kafka schema registry.
+
+  examples: |
+    To delete a schema registry named myschemaregistry located in us-central1,
+    run the following:
+
+      $ {command} myschemaregistry \
+          --location=us-central1
+
+request:
+  collection: managedkafka.projects.locations.schemaRegistries
+
+arguments:
+  resource:
+    help_text: Identifies the schema registry for deletion.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:schema_registry

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/schema_registries/describe.py

@@ -0,0 +1,139 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Implementation of gcloud managed kafka schema registries describe command."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.util import apis
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.managed_kafka import arguments
+from googlecloudsdk.command_lib.managed_kafka import util
+from googlecloudsdk.core import log
+from googlecloudsdk.core import resources
+
+PROJECTS_RESOURCE_PATH = 'projects/'
+LOCATIONS_RESOURCE_PATH = 'locations/'
+SCHEMA_REGISTRIES_RESOURCE_PATH = 'schemaRegistries/'
+
+SCHEMA_REGISTRY_FORMAT = """
+    table(
+      schema_registry:format='yaml(compatibility, schema_registry.compatibility, mode, schema_registry.mode, name, schema_registry.name, contexts, schema_registry.contexts)'
+    )
+"""
+
+
+class _Results(object):
+  """Encapsulate results into a single object to fit the Run() model."""
+
+  def __init__(self, schema_registry):
+    self.schema_registry = schema_registry
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA)
+@base.DefaultUniverseOnly
+class Describe(base.DescribeCommand):
+  """Describe a schema registry with all of its fields.
+
+  ## EXAMPLES
+
+   Describe the schema registry with all of its fields:
+
+    $ {command} --project=PROJECT_ID --location=LOCATION_ID
+    --schema_registry=SCHEMA_REGISTRY_ID
+  """
+
+  @staticmethod
+  def Args(parser):
+    """Register flags for this command."""
+
+    parser.display_info.AddFormat(SCHEMA_REGISTRY_FORMAT)
+
+    arguments.AddSchemaRegistryArgToParser(parser)
+
+  def Run(self, args):
+    """Called when the user runs gcloud managed-kafka schema-registries describe ...
+
+    Args:
+      args: all the arguments that were provided to this command invocation.
+
+    Returns:
+      The schema registry.
+    """
+    client = apis.GetClientInstance('managedkafka', 'v1')
+    message = client.MESSAGES_MODULE
+
+    project_id = util.ParseProject(args.project)
+    location = args.location
+    schema_registry_id = args.schema_registry
+    schema_registry_resource = resources.REGISTRY.Parse(
+        schema_registry_id,
+        collection='managedkafka.projects.locations.schemaRegistries',
+        params={
+            'projectsId': project_id,
+            'locationsId': location,
+            'schemaRegistriesId': schema_registry_id,
+        },
+    )
+
+    schema_registry_path = schema_registry_resource.RelativeName()
+
+    log.status.Print(
+        'Describing schema registry [{}].'.format(schema_registry_id) + '\n'
+    )
+
+    schema_registry_request = (
+        message.ManagedkafkaProjectsLocationsSchemaRegistriesGetRequest(
+            name=schema_registry_path
+        )
+    )
+    schema_registry_mode_request = (
+        message.ManagedkafkaProjectsLocationsSchemaRegistriesModeGetRequest(
+            name=f'{schema_registry_path}/mode'
+        )
+    )
+    schema_registry_config_request = (
+        message.ManagedkafkaProjectsLocationsSchemaRegistriesConfigGetRequest(
+            name=f'{schema_registry_path}/config'
+        )
+    )
+
+    schema_registry = client.projects_locations_schemaRegistries.Get(
+        request=schema_registry_request
+    )
+    schema_registry_mode = client.projects_locations_schemaRegistries_mode.Get(
+        request=schema_registry_mode_request
+    )
+    schema_registry_config = (
+        client.projects_locations_schemaRegistries_config.Get(
+            request=schema_registry_config_request,
+        )
+    )
+
+    mode = util.ParseMode(schema_registry_mode.mode)
+
+    compatibility = util.ParseCompatibility(
+        schema_registry_config.compatibility
+    )
+
+    schema_registry = {
+        'name': schema_registry.name,
+        'contexts': schema_registry.contexts,
+        'mode': mode,
+        'compatibility': compatibility,
+    }
+
+    return _Results(schema_registry)

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/schema_registries/list.yaml

@@ -0,0 +1,22 @@
+release_tracks: [ALPHA, BETA]
+
+help_text:
+  brief: |
+    List all Managed Service for Apache Kafka schema registries in a given location.
+  description: |
+    List all Managed Service for Apache Kafka schema registries in a given location.
+    To specify the maximum number of clusters to list, use the --limit flag.
+
+  examples: |
+    To list all schema registries in a given location, such as us-central1, run the following:
+
+      $ {command} --location=us-central1
+
+request:
+  collection: managedkafka.projects.locations.schemaRegistries
+
+arguments:
+  resource:
+    help_text: |
+      Identifies the region which contains all the schema registries to be listed.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:location

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/schema_registries/subjects/__init__.py

@@ -0,0 +1,28 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Managed Service for Apache Kafka schema-registries operations."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class SchemaRegistries(base.Group):
+  """Administer Managed Service for Apache Kafka schema-registries."""
+
+  category = base.DATA_ANALYTICS_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/schema_registries/subjects/describe.py

@@ -0,0 +1,183 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Implementation of gcloud managed kafka schema registries subjects describe command."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from apitools.base.py import exceptions as apitools_exceptions
+from googlecloudsdk.api_lib.util import apis
+from googlecloudsdk.calliope import base
+from googlecloudsdk.calliope import exceptions
+from googlecloudsdk.command_lib.managed_kafka import arguments
+from googlecloudsdk.command_lib.managed_kafka import util
+from googlecloudsdk.core import log
+from googlecloudsdk.core import resources
+
+PROJECTS_RESOURCE_PATH = 'projects/'
+LOCATIONS_RESOURCE_PATH = 'locations/'
+SCHEMA_REGISTRIES_RESOURCE_PATH = 'schemaRegistries/'
+SUBJECTS_RESOURCE_PATH = '/subjects/'
+CONTEXTS_RESOURCE_PATH = '/contexts/'
+
+SUBJECT_FORMAT = """
+    table(
+      subject:format='yaml(compatibility, subject.compatibility, mode, subject.mode, name, subject.name)'
+    )
+"""
+
+
+class _Results(object):
+  """Encapsulate results into a single object to fit the Run() model."""
+
+  def __init__(self, subject):
+    self.subject = subject
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+@base.DefaultUniverseOnly
+class Describe(base.DescribeCommand):
+  """Describe a subject in a schema registry with all of its fields.
+
+  ## EXAMPLES
+
+   Describe the subject in a schema registry with all of its fields:
+
+    $ {command} --project=PROJECT_ID --location=LOCATION_ID
+    --registry=SCHEMA_REGISTRY_ID
+  """
+
+  @staticmethod
+  def Args(parser):
+    """Register flags for this command."""
+
+    parser.display_info.AddFormat(SUBJECT_FORMAT)
+
+    parser.add_argument(
+        '--context',
+        type=str,
+        help='The context of the subject.',
+    )
+
+    arguments.AddSubjectArgToParser(parser)
+
+  def Run(self, args):
+    """Called when the user runs gcloud managed-kafka schema-registries subjects describe ...
+
+    Args:
+      args: all the arguments that were provided to this command invocation.
+
+    Returns:
+      The subject.
+    """
+    client = apis.GetClientInstance('managedkafka', 'v1')
+    message = client.MESSAGES_MODULE
+
+    project_id = util.ParseProject(args.project)
+    location = args.location
+    schema_registry_id = args.registry
+    subject = args.CONCEPTS.subject.Parse().subjectsId
+    subject_run_resource = resources.REGISTRY.Parse(
+        args.subject,
+        collection='managedkafka.projects.locations.schemaRegistries.subjects',
+        params={
+            'projectsId': project_id,
+            'locationsId': location,
+            'schemaRegistriesId': schema_registry_id,
+            'subjectsId': subject,
+        },
+    )
+    schema_registry_resource = subject_run_resource.Parent().RelativeName()
+    subject_resource_path = subject_run_resource.RelativeName()
+    if args.context:
+      subject_resource_path = f'{schema_registry_resource}{CONTEXTS_RESOURCE_PATH}{args.context}{SUBJECTS_RESOURCE_PATH}{subject}'
+      schema_registry_resource = (
+          f'{schema_registry_resource}{CONTEXTS_RESOURCE_PATH}{args.context}'
+      )
+
+    log.status.Print('Describing subject [{}].'.format(subject) + '\n')
+
+    subject_mode_request = (
+        message.ManagedkafkaProjectsLocationsSchemaRegistriesModeGetRequest(
+            name=f'{schema_registry_resource}/mode/{subject}'
+        )
+    )
+    subject_config_request = (
+        message.ManagedkafkaProjectsLocationsSchemaRegistriesConfigGetRequest(
+            name=f'{schema_registry_resource}/config/{subject}'
+        )
+    )
+
+    mode = 'None'
+    compatibility = 'None'
+    try:
+      subject_mode = client.projects_locations_schemaRegistries_mode.Get(
+          request=subject_mode_request
+      )
+      mode = util.ParseMode(subject_mode.mode)
+    except apitools_exceptions.HttpNotFoundError as e:
+      api_error = exceptions.HttpException(e, util.HTTP_ERROR_FORMAT)
+      if 'Resource not found' in api_error.message:
+        raise exceptions.HttpException(
+            e, error_format='Subject {} not found.'.format(subject)
+        )
+      try:
+        schema_registry_mode_request = (
+            message.ManagedkafkaProjectsLocationsSchemaRegistriesModeGetRequest(
+                name=f'{schema_registry_resource}/mode'
+            )
+        )
+        schema_registry_mode = (
+            client.projects_locations_schemaRegistries_mode.Get(
+                request=schema_registry_mode_request
+            )
+        )
+        mode = util.ParseMode(schema_registry_mode.mode)
+        mode = f'{mode} (from registry)'
+      except apitools_exceptions.HttpNotFoundError as inner_e:
+        # Should not happen.
+        raise exceptions.HttpException(inner_e)
+
+    try:
+      subject_config = client.projects_locations_schemaRegistries_config.Get(
+          request=subject_config_request,
+      )
+      compatibility = util.ParseCompatibility(subject_config.compatibility)
+    except apitools_exceptions.HttpNotFoundError:
+      try:
+        schema_registry_config_request = message.ManagedkafkaProjectsLocationsSchemaRegistriesConfigGetRequest(
+            name=f'{schema_registry_resource}/config'
+        )
+        schema_registry_config = (
+            client.projects_locations_schemaRegistries_config.Get(
+                request=schema_registry_config_request,
+            )
+        )
+        compatibility = util.ParseCompatibility(
+            schema_registry_config.compatibility
+        )
+        compatibility = f'{compatibility} (from registry)'
+      except apitools_exceptions.HttpNotFoundError as inner_e:
+        # Should not happen.
+        raise exceptions.HttpException(inner_e)
+
+    verbose_subject = {
+        'name': subject_resource_path,
+        'mode': mode,
+        'compatibility': compatibility,
+    }
+
+    return _Results(verbose_subject)

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/schema_registries/subjects/update.py

@@ -0,0 +1,191 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Implementation of gcloud managed kafka schema registries subjects update command."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.util import apis
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.managed_kafka import arguments
+from googlecloudsdk.command_lib.managed_kafka import util
+from googlecloudsdk.core import log
+from googlecloudsdk.core import resources
+from googlecloudsdk.generated_clients.apis.managedkafka.v1 import managedkafka_v1_messages
+
+PROJECTS_RESOURCE_PATH = 'projects/'
+LOCATIONS_RESOURCE_PATH = 'locations/'
+SCHEMA_REGISTRIES_RESOURCE_PATH = 'schemaRegistries/'
+SUBJECTS_RESOURCE_PATH = 'subjects/'
+CONTEXTS_RESOURCE_PATH = '/contexts/'
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+@base.DefaultUniverseOnly
+class Update(base.UpdateCommand):
+  """Update the mode and compatibility of a subject.
+
+  ## EXAMPLES
+
+  Modify the mode of the subject to READONLY:
+
+    $ {command} --registry=SCHEMA_REGISTRY --context=CONTEXT
+    --project=PROJECT_ID --location=LOCATION_ID --mode=READONLY
+
+  Modify the compatibility of the subject to BACKWARDS:
+
+    $ {command} --registry=SCHEMA_REGISTRY --context=CONTEXT
+    --project=PROJECT_ID --location=LOCATION_ID --compatibility=BACKWARDS
+  """
+
+  @staticmethod
+  def Args(parser):
+    """Register flags for this command."""
+
+    arguments.AddSubjectArgToParser(parser)
+
+    parser.add_argument(
+        '--context',
+        type=str,
+        help='The context of the subject.',
+    )
+
+    group = parser.add_mutually_exclusive_group(required=True)
+
+    group.add_argument(
+        '--mode',
+        type=str,
+        help='The mode of the subject to update.',
+    )
+    group.add_argument(
+        '--compatibility',
+        type=str,
+        help='The compatibility of the subject to update.',
+    )
+    group.add_argument(
+        '--delete-mode',
+        action='store_true',
+        help='Delete the mode of the subject.',
+    )
+    group.add_argument(
+        '--delete-config',
+        action='store_true',
+        help='Delete the config of the subject.',
+    )
+
+  def Run(self, args):
+    """Called when the user runs gcloud managed-kafka schema-registries subjects update ...
+
+    Args:
+      args: all the arguments that were provided to this command invocation.
+
+    Returns:
+      The updated subject.
+    """
+
+    client = apis.GetClientInstance('managedkafka', 'v1')
+    message = client.MESSAGES_MODULE
+
+    project_id = util.ParseProject(args.project)
+    location = args.location
+    schema_registry_id = args.registry
+    subject = args.CONCEPTS.subject.Parse().subjectsId
+    subject_run_resource = resources.REGISTRY.Parse(
+        args.subject,
+        collection='managedkafka.projects.locations.schemaRegistries.subjects',
+        params={
+            'projectsId': project_id,
+            'locationsId': location,
+            'schemaRegistriesId': schema_registry_id,
+            'subjectsId': subject,
+        },
+    )
+    schema_registry_resource = subject_run_resource.Parent().RelativeName()
+    if args.context:
+      schema_registry_resource = (
+          f'{schema_registry_resource}{CONTEXTS_RESOURCE_PATH}{args.context}'
+      )
+
+    if args.delete_config:
+      util.DeleteSubjectConfig(subject, schema_registry_resource, args.context)
+
+    if args.delete_mode:
+      util.DeleteSubjectMode(subject, schema_registry_resource, args.context)
+
+    if args.mode:
+      mode = args.mode.upper()
+      name = f'{schema_registry_resource}/mode/{args.CONCEPTS.subject.Parse().subjectsId}'
+      updatemoderequest = message.UpdateSchemaModeRequest()
+      updatemoderequest.mode = (
+          managedkafka_v1_messages.UpdateSchemaModeRequest.ModeValueValuesEnum(
+              mode
+          )
+      )
+      # Check if context is provided.
+      if args.context:
+        request = message.ManagedkafkaProjectsLocationsSchemaRegistriesContextsModeUpdateRequest(
+            name=name, updateSchemaModeRequest=updatemoderequest
+        )
+        response = (
+            client.projects_locations_schemaRegistries_contexts_mode.Update(
+                request=request
+            )
+        )
+      else:
+        request = message.ManagedkafkaProjectsLocationsSchemaRegistriesModeUpdateRequest(
+            name=name, updateSchemaModeRequest=updatemoderequest
+        )
+        response = client.projects_locations_schemaRegistries_mode.Update(
+            request=request
+        )
+
+      log.UpdatedResource(subject, details='mode to %s' % response.mode)
+
+    if args.compatibility:
+      compatibility = args.compatibility.upper()
+      name = f'{schema_registry_resource}/config/{args.CONCEPTS.subject.Parse().subjectsId}'
+      updateconfigrequest = message.UpdateSchemaConfigRequest()
+      updateconfigrequest.compatibility = managedkafka_v1_messages.UpdateSchemaConfigRequest.CompatibilityValueValuesEnum(
+          compatibility
+      )
+      # Check if context is provided.
+      if args.context:
+        request = message.ManagedkafkaProjectsLocationsSchemaRegistriesContextsConfigUpdateRequest(
+            name=name, updateSchemaConfigRequest=updateconfigrequest
+        )
+        response = (
+            client.projects_locations_schemaRegistries_contexts_config.Update(
+                request=request
+            )
+        )
+      else:
+        request = message.ManagedkafkaProjectsLocationsSchemaRegistriesConfigUpdateRequest(
+            name=name, updateSchemaConfigRequest=updateconfigrequest
+        )
+        response = client.projects_locations_schemaRegistries_config.Update(
+            request=request
+        )
+
+      log.UpdatedResource(
+          subject, details='compatibility to %s' % response.compatibility
+      )
+
+      # TODO: b/418768300 - Add normalize and alias to the output once they
+      # are supported.
+      log.status.Print(
+          'Current subject config: \n - compatibility: %s'
+          % (response.compatibility)
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/schema_registries/update.py

@@ -0,0 +1,137 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Implementation of gcloud managed kafka schema registries update command."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.util import apis
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.managed_kafka import arguments
+from googlecloudsdk.command_lib.managed_kafka import util
+from googlecloudsdk.core import log
+from googlecloudsdk.core import resources
+from googlecloudsdk.generated_clients.apis.managedkafka.v1 import managedkafka_v1_messages
+
+PROJECTS_RESOURCE_PATH = 'projects/'
+LOCATIONS_RESOURCE_PATH = 'locations/'
+SCHEMA_REGISTRIES_RESOURCE_PATH = 'schemaRegistries/'
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+@base.DefaultUniverseOnly
+class Update(base.UpdateCommand):
+  """Update the mode and compatibility of a schema registry.
+
+  ## EXAMPLES
+
+  Modify the mode of the schema registry to READONLY:
+
+    $ {command} --mode=READONLY
+
+  Modify the compatibility of the schema registry to BACKWARDS:
+
+    $ {command} --compatibility=BACKWARDS
+  """
+
+  @staticmethod
+  def Args(parser):
+    """Register flags for this command."""
+    arguments.AddSchemaRegistryArgToParser(parser)
+
+    group = parser.add_mutually_exclusive_group(required=True)
+
+    group.add_argument(
+        '--mode',
+        type=str,
+        help='The mode of the schema registry to update.',
+    )
+    group.add_argument(
+        '--compatibility',
+        type=str,
+        help='The compatibility of the schema registry to update.',
+    )
+
+  def Run(self, args):
+    """Called when the user runs gcloud managed-kafka schema-registries update ...
+
+    Args:
+      args: all the arguments that were provided to this command invocation.
+
+    Returns:
+      The updated schema registry.
+    """
+
+    client = apis.GetClientInstance('managedkafka', 'v1')
+    message = client.MESSAGES_MODULE
+
+    project_id = util.ParseProject(args.project)
+    location = args.location
+    schema_registry_resource = resources.REGISTRY.Parse(
+        args.schema_registry,
+        collection='managedkafka.projects.locations.schemaRegistries',
+        params={
+            'projectsId': project_id,
+            'locationsId': location,
+            'schemaRegistriesId': args.schema_registry,
+        },
+    )
+
+    schema_registry_path = schema_registry_resource.RelativeName()
+
+    if args.mode:
+      name = schema_registry_path + '/mode'
+      updatemoderequest = message.UpdateSchemaModeRequest()
+      updatemoderequest.mode = (
+          managedkafka_v1_messages.UpdateSchemaModeRequest.ModeValueValuesEnum(
+              args.mode
+          )
+      )
+      request = message.ManagedkafkaProjectsLocationsSchemaRegistriesContextsModeUpdateRequest(
+          name=name, updateSchemaModeRequest=updatemoderequest
+      )
+      response = (
+          client.projects_locations_schemaRegistries_contexts_mode.Update(
+              request=request
+          )
+      )
+      log.UpdatedResource(
+          args.schema_registry, details='mode to %s' % response.mode
+      )
+    if args.compatibility:
+      name = schema_registry_path + '/config'
+      updateconfigrequest = message.UpdateSchemaConfigRequest()
+      updateconfigrequest.compatibility = managedkafka_v1_messages.UpdateSchemaConfigRequest.CompatibilityValueValuesEnum(
+          args.compatibility
+      )
+      request = message.ManagedkafkaProjectsLocationsSchemaRegistriesContextsConfigUpdateRequest(
+          name=name, updateSchemaConfigRequest=updateconfigrequest
+      )
+      response = (
+          client.projects_locations_schemaRegistries_contexts_config.Update(
+              request=request
+          )
+      )
+      log.UpdatedResource(
+          args.schema_registry,
+          details='compatibility to %s' % response.compatibility,
+      )
+      # TODO: b/418768300 - Add normalize and alias to the output once they
+      # are supported.
+      log.status.Print(
+          'Current schema registry config: \n - compatibility: %s'
+          % (response.compatibility)
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/topics/__init__.py

@@ -0,0 +1,29 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2024 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Managed Service for Apache Kafka topics operations."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(
+    base.ReleaseTrack.GA, base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA
+)
+class Topics(base.Group):
+  """Administer Managed Service for Apache Kafka topics."""
+  category = base.DATA_ANALYTICS_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/topics/create.yaml

@@ -0,0 +1,32 @@
+release_tracks: [GA, ALPHA, BETA]
+
+help_text:
+  brief: |
+    Create a Managed Service for Apache Kafka topic.
+  description: |
+    Create a Managed Service for Apache Kafka topic.
+
+  examples: |
+    To create a topic in a cluster named mycluster located in us-central1,
+    run the following:
+
+      $ {command} mytopic \
+          --cluster=mycluster
+          --location=us-central1 \
+          --partitions=1 \
+          --replication-factor=3
+
+request:
+  collection: managedkafka.projects.locations.clusters.topics
+
+arguments:
+  resource:
+    help_text: Identifies the name of the topic that this command creates.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:topic
+
+  params:
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:partitions
+    required: true
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:replication-factor
+    required: true
+  - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:configs

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/topics/delete.yaml

@@ -0,0 +1,23 @@
+release_tracks: [GA, ALPHA, BETA]
+
+help_text:
+  brief: |
+    Delete a Managed Service for Apache Kafka topic.
+  description: |
+    Delete a Managed Service for Apache Kafka topic.
+
+  examples: |
+    To delete a topic in a cluster named mycluster located in us-central1,
+    run the following:
+
+      $ {command} mytopic \
+          --cluster=mycluster \
+          --location=us-central1
+
+request:
+  collection: managedkafka.projects.locations.clusters.topics
+
+arguments:
+  resource:
+    help_text: Identifies the topic for deletion.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:topic

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/topics/describe.yaml

@@ -0,0 +1,23 @@
+release_tracks: [GA, ALPHA, BETA]
+
+help_text:
+  brief: |
+    Describe a Managed Service for Apache Kafka topic.
+  description: |
+    Describe a Managed Service for Apache Kafka topic.
+
+  examples: |
+    To describe a topic in a cluster named mycluster located in us-central1,
+    run the following:
+
+      $ {command} mytopic \
+          --cluster=mycluster \
+          --location=us-central1
+
+request:
+  collection: managedkafka.projects.locations.clusters.topics
+
+arguments:
+  resource:
+    help_text: The describe command displays properties of the topic specified by this parameter.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:topic

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/topics/list.yaml

@@ -0,0 +1,24 @@
+release_tracks: [GA, ALPHA, BETA]
+
+help_text:
+  brief: |
+    List all Managed Service for Apache Kafka topics in a given cluster.
+  description: |
+    List all Managed Service for Apache Kafka topics in a given cluster.
+    To specify the maximum number of topics to list, use the --limit flag.
+
+  examples: |
+    To list all topics in a cluster named mycluster located in us-central1,
+    run the following:
+
+      $ {command} mycluster
+          --location=us-central1
+
+request:
+  collection: managedkafka.projects.locations.clusters.topics
+
+arguments:
+  resource:
+    is_positional: true
+    help_text: Identifies the cluster which contains all the topics to be listed.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:cluster

gcloud auth application-default login/google-cloud-sdk/lib/surface/managed_kafka/topics/update.yaml

@@ -0,0 +1,36 @@
+release_tracks: [GA, ALPHA, BETA]
+
+help_text:
+  brief: |
+    Update a Managed Service for Apache Kafka topic.
+  description: |
+    Update a Managed Service for Apache Kafka topic.
+
+  examples: |
+    To update an attribute in a topic, such as the partitions, for a cluster named mycluster
+    located in us-central1, run the following:
+
+      $ {command} mytopic \
+          --cluster=mycluster \
+          --location=us-central1 \
+          --partitions=3
+
+request:
+  collection: managedkafka.projects.locations.clusters.topics
+  modify_request_hooks:
+  - googlecloudsdk.command_lib.managed_kafka.util:PatchConfigs
+
+arguments:
+  resource:
+    help_text: Identifies the topic to be updated.
+    spec: !REF googlecloudsdk.command_lib.managed_kafka.resources:topic
+  params:
+  - group:
+      required: true
+      params:
+      - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:partitions
+      - group:
+          mutex: true
+          params:
+          - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:configs
+          - _REF_: googlecloudsdk.command_lib.managed_kafka.flags:clear-configs