feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/__init__.py

@@ -0,0 +1,35 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2020 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The super-group for the metastore CLI."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class Metastore(base.Group):
+  """Manage Dataproc Metastore resources."""
+
+  category = base.DATA_ANALYTICS_CATEGORY
+
+  def Filter(self, context, args):
+    # TODO(b/190537289):  Determine if command group works with project number
+    base.RequireProjectID(args)
+    del context, args

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/federations/__init__.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for Dataproc Metastore federation."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+class Federations(base.Group):
+  """Manage Dataproc Metastore federations."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/federations/add_iam_policy_binding.yaml

@@ -0,0 +1,32 @@
+release_tracks: [ALPHA, BETA, GA]
+help_text:
+  brief: Add an IAM policy binding to a federation.
+  description: |
+    Add an IAM policy binding to a federation.
+
+  examples: |
+    To add an IAM policy binding for the role of `roles/metastore.admin` for the user
+    `test-user@gmail.com`, run:
+
+      $ {command} my-federation --member='user:test-user@gmail.com' --role='roles/metastore.admin'
+
+    See https://cloud.google.com/dataproc-metastore/docs/iam-and-access-control for details of
+    policy role and member types.
+
+request:
+  collection: metastore.projects.locations.federations
+  ALPHA:
+    api_version: v1alpha
+  BETA:
+    api_version: v1beta
+  GA:
+    api_version: v1
+
+iam:
+  enable_condition: false
+  policy_version: 0
+
+arguments:
+  resource:
+    help_text: Federation for which to add the IAM policy to.
+    spec: !REF googlecloudsdk.command_lib.metastore.resources:federation

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/federations/create.yaml

@@ -0,0 +1,74 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: |
+      Create a Dataproc Metastore federation.
+    description: |
+      Create a new Dataproc Metastore federation with the given name and configurations.
+
+      If run asynchronously with `--async`, exits after printing
+      one operation name that can be used to poll the status of the
+      creation via:
+
+        {top_command} metastore operations describe
+    examples: |
+      To create a Dataproc Metastore federation with the name `my-metastore-federation` in location
+      `us-central` with two backends `dpms1` and `dpms2`, run:
+
+          $ {command} my-metastore-federation --location=us-central1 --backends=1=dpms:dpms1,2=dpms:projects/my-project/locations/us-central1/services/dpms2
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.metastore.federations.util:GenerateCreateBackends
+    collection: metastore.projects.locations.federations
+
+  arguments:
+    resource:
+      help_text: |
+        Arguments and flags that specify the Dataproc Metastore federation
+        you want to create.
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:federation
+    params:
+    - arg_name: hive-metastore-version
+      api_field: federation.version
+      choices:
+      - arg_value: 3.1.2
+        enum_value: 3.1.2
+      - arg_value: 2.3.6
+        enum_value: 2.3.6
+      help_text:  |
+          Hive metastore schema version of the Metastore federation.
+    - arg_name: backends
+      api_field:  federation.backendMetastores
+      required: true
+      metavar: RANK=BACKEND
+      processor: googlecloudsdk.command_lib.metastore.validators:ValidateBackendsAndReturnMetastoreDict
+      help_text:  |
+          Backends from which the federation service serves metadata at query time. The backends are specified as a comma-separated
+          list of `RANK=BACKEND` pairs.
+          For example: `1=dpms:dpms1,2=dpms:projects/my-project/locations/us-central1/services/dpms2`.
+          `RANK` represents the rank of the backend metastore and is used to resolve database name collisions.
+          `BACKEND` is specified as `METASTORE_TYPE:METASTORE_NAME` where `METASTORE_TYPE` is the type of backend metastore and
+          `METASTORE_NAME` is the relative resource name of the metastore. If only the name of the metastore is specified (e.g. `dpms1`),
+          project and location will be inferred from the project and location used to create the federation.
+    - arg_name: tags
+      api_field: federation.tags.additionalProperties
+      metavar: KEY=VALUE
+      help_text: |
+        List of tag KEY=VALUE pairs to add.
+      type:
+        arg_dict:
+          flatten: true
+          spec:
+          - api_field: key
+          - api_field: value
+    labels:
+      api_field: federation.labels
+
+  async:
+    collection: metastore.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/federations/delete.py

@@ -0,0 +1,111 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command to delete one or more Dataproc Metastore federations."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from apitools.base.py import exceptions as apitools_exceptions
+from googlecloudsdk.api_lib.metastore import federations_util as federations_api_util
+from googlecloudsdk.api_lib.metastore import util as api_util
+from googlecloudsdk.api_lib.util import exceptions
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.metastore import delete_util
+from googlecloudsdk.command_lib.metastore import resource_args
+from googlecloudsdk.command_lib.metastore import util as command_util
+from googlecloudsdk.core import log
+from googlecloudsdk.core.console import console_io
+
+DETAILED_HELP = {
+    'EXAMPLES':
+        """\
+          To delete a Dataproc Metastore federation with the name
+          `my-metastore-federation` in location `us-central1`, run:
+
+          $ {command} my-metastore-federation --location=us-central1
+
+          To delete multiple Dataproc Metastore federations with the name
+          `federation-1` and `federation-2` in the same location
+          `us-central1`, run:
+
+          $ {command} federation-1 federation-2 --location=us-central1
+        """
+}
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+class Delete(base.DeleteCommand):
+  """Delete one or more Dataproc Metastore federations.
+
+  If run asynchronously with `--async`, exits after printing
+  one or more operation names that can be used to poll the status of the
+  deletion(s) via:
+
+    {top_command} metastore operations describe
+  """
+
+  detailed_help = DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddFederationResourceArg(
+        parser, 'to delete', plural=True, required=True, positional=True)
+    base.ASYNC_FLAG.AddToParser(parser)
+
+  def Run(self, args):
+    env_refs = args.CONCEPTS.federations.Parse()
+    console_io.PromptContinue(
+        message=command_util.ConstructList(
+            'Deleting the following federations:', [
+                '[{}] in [{}]'.format(env_ref.federationsId,
+                                      env_ref.locationsId)
+                for env_ref in env_refs
+            ]),
+        cancel_on_no=True,
+        cancel_string='Deletion aborted by user.',
+        throw_if_unattended=True)
+
+    waiter = delete_util.FederationDeletionWaiter(
+        release_track=self.ReleaseTrack())
+    encountered_errors = False
+    for env_ref in env_refs:
+      operation = None
+      failed = None
+      try:
+        operation = federations_api_util.Delete(
+            env_ref.RelativeName(), release_track=self.ReleaseTrack())
+      except apitools_exceptions.HttpError as e:
+        exc = exceptions.HttpException(e)
+        failed = exc.payload.status_message
+        encountered_errors = True
+      else:
+        waiter.AddPendingDelete(
+            federation_name=env_ref.RelativeName(), operation=operation)
+      finally:
+        log.DeletedResource(
+            env_ref.RelativeName(),
+            kind='federation',
+            is_async=True,
+            details=None if encountered_errors else
+            'with operation [{0}]'.format(operation.name),
+            failed=failed)
+
+    if not args.async_:
+      encountered_errors = waiter.Wait() or encountered_errors
+    if encountered_errors:
+      raise api_util.FederationDeleteError(
+          'Some requested deletions did not succeed.')

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/federations/describe.yaml

@@ -0,0 +1,29 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: |
+      Describe a Dataproc Metastore federation.
+    description: |
+      Describe a Dataproc Metastore federation.
+
+      Displays all details of a Dataproc Metastore federation given a valid federation ID.
+    examples: |
+      To describe a Dataproc Metastore federation with the ID
+      `my-metastore-federation` in `us-central1`, run:
+
+        $ {command} my-metastore-federation --location=us-central1
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: metastore.projects.locations.federations
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:federation
+      help_text: |
+        Arguments and flags that specify the Metastore federation you want
+        to describe.

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/federations/get_iam_policy.yaml

@@ -0,0 +1,34 @@
+release_tracks: [ALPHA, BETA, GA]
+help_text:
+  brief: Get the IAM policy for the federation.
+  description: |
+    `{command}` displays the IAM policy associated with the federation.
+    If formatted as JSON, the output can be edited and used as a
+    policy file for set-iam-policy. The output includes an "etag" field
+    identifying the version emitted and allowing detection of
+    concurrent policy updates. The "etag" field should be removed to be
+    used as set-iam-policy input; see `{parent_command} set-iam-policy`
+    for additional details.
+  examples: |
+    To print the IAM policy for a given federation, run:
+
+      $ {command} my-federation
+
+request:
+  collection: metastore.projects.locations.federations
+  ALPHA:
+    api_version: v1alpha
+  BETA:
+    api_version: v1beta
+  GA:
+    api_version: v1
+
+iam:
+  enable_condition: false
+  policy_version: 0
+  get_iam_policy_version_path: options_requestedPolicyVersion
+
+arguments:
+  resource:
+    help_text: Federation for which to display the IAM policy.
+    spec: !REF googlecloudsdk.command_lib.metastore.resources:federation

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/federations/list.yaml

@@ -0,0 +1,42 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: |
+      List Dataproc Metastore federations.
+    description: |
+      Lists all federations under the specified project and location.
+    examples: |
+      To list all Dataproc Metastore federations in location
+      `us-central1`, run:
+
+        $ {command} --location=us-central1
+
+      To list all Dataproc Metastore federations in all locations,
+      run:
+
+        $ {command} --location=-
+
+  arguments:
+    resource:
+      help_text: The location of the federations to list.
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:location
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: metastore.projects.locations.federations
+  response:
+    id_field: name
+
+  output:
+    format: |
+      table(
+        name.basename():label=NAME,
+        name.segment(3):label=LOCATION,
+        state:label=STATE,
+        endpointUri:label=URI,
+        version:label=METASTORE_VERSION
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/federations/remove_iam_policy_binding.yaml

@@ -0,0 +1,32 @@
+release_tracks: [ALPHA, BETA, GA]
+help_text:
+  brief: Remove an IAM policy binding from a federation.
+  description: |
+    Remove an IAM policy binding from a federation.
+
+  examples: |
+    To remove an IAM policy binding for the role of `roles/metastore.admin` for the user
+    `test-user@gmail.com`, run:
+
+      $ {command} my-federation --member='user:test-user@gmail.com' --role='roles/metastore.admin'
+
+    See https://cloud.google.com/iam/docs/managing-policies for details of
+    policy role and member types.
+
+request:
+  collection: metastore.projects.locations.federations
+  ALPHA:
+    api_version: v1alpha
+  BETA:
+    api_version: v1beta
+  GA:
+    api_version: v1
+
+iam:
+  enable_condition: false
+  policy_version: 0
+
+arguments:
+  resource:
+    help_text: Federation for which to remove the IAM policy from.
+    spec: !REF googlecloudsdk.command_lib.metastore.resources:federation

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/federations/set_iam_policy.yaml

@@ -0,0 +1,33 @@
+release_tracks: [ALPHA, BETA, GA]
+help_text:
+  brief: Set the IAM policy for the federation.
+  description: |
+    Sets the IAM policy for the given federation as defined in a JSON or YAML file.
+
+    See https://cloud.google.com/iam/docs/managing-policies for details of
+    the policy file format and contents.
+
+  examples: |
+    The following command will read an IAM policy defined in a JSON file
+    `policy.json` and set it for the federation `my-federation`:
+
+    $ {command} my-federation policy.json
+
+request:
+  collection: metastore.projects.locations.federations
+  ALPHA:
+    api_version: v1alpha
+  BETA:
+    api_version: v1beta
+  GA:
+    api_version: v1
+
+iam:
+  enable_condition: false
+  policy_version: 0
+  get_iam_policy_version_path: options.requestedPolicyVersion
+
+arguments:
+  resource:
+    help_text: Federation for which to display the IAM policy.
+    spec: !REF googlecloudsdk.command_lib.metastore.resources:federation

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/federations/update.yaml

@@ -0,0 +1,72 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: |
+      Update a Dataproc Metastore federation.
+    description: |
+      Update the metadata and/or configuration parameters of a Dataproc Metastore federation.
+
+      If run asynchronously with `--async`, exits after printing
+      one operation name that can be used to poll the status of the
+      update via:
+
+        {top_command} metastore operations describe
+    examples: |
+      To update a Dataproc Metastore federation with the name `my-metastore-federation` in location
+      `us-central` with two backends `dpms1` and `dpms2`, run:
+
+          $ {command} my-metastore-federation --location=us-central1 --update-backends=1=dpms:dpms1,2=dpms:projects/my-project/locations/us-central1/services/dpms2
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.metastore.validators:ValidateClearBackends
+    - googlecloudsdk.command_lib.metastore.federations.util:GenerateUpdateBackends
+    collection: metastore.projects.locations.federations
+
+  arguments:
+    resource:
+      help_text: |
+        Arguments and flags that specify the Dataproc Metastore federation
+        you want to update.
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:federation
+    params:
+    - group:
+        help_text: |
+          Update the backend metastores by passing key-value pairs in through the flags.
+        required: true
+        params:
+        - arg_name: update-backends
+          metavar: RANK=BACKEND
+          api_field: federation.backendMetastores
+          processor: googlecloudsdk.command_lib.metastore.validators:ValidateBackendsAndReturnMetastoreDict
+          help_text: |
+              Comma-separated list of metastore backends specified as a list of `RANK=BACKEND` pairs. For example: `1=dpms:dpms1,2=dpms:projects/my-project/locations/us-central1/services/dpms2`.
+              `RANK` represents the rank of the backend metastore and is used to resolve database name collisions.
+              `BACKEND` is specified as `METASTORE_TYPE:METASTORE_NAME` where `METASTORE_TYPE` is the type of backend metastore and
+              `METASTORE_NAME` is the relative resource name of the metastore. If only the name of the metastore is specified (e.g. `dpms1`),
+               project and location will be inferred from the project and location used to create the federation.
+        - group:
+            mutex: true
+            params:
+            - arg_name: remove-backends
+              metavar: RANK
+              help_text: |
+                Comma-separated list of metastore backend keys to remove with the form `RANK1,RANK2`. The Key represents the rank of the backend metastore and is used to resolve database name collisions.
+                If a `RANK` does not exist then it is sliently ignored. If `--update-backends` is also specified, then `--remove-backends` is applied first.
+            - arg_name: clear-backends
+              action: store_true
+              help_text: |
+                Clear existing metastore backends. `--clear-backends` must be used with `--update-backends`.
+    labels:
+      api_field: federation.labels
+
+  async:
+    collection: metastore.projects.locations.operations
+  update:
+    read_modify_update: true
+    disable_auto_field_mask: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/locations/__init__.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2020 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for Dataproc Metastore locations."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+class Locations(base.Group):
+  """Get information about Dataproc Metastore locations."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/locations/describe.yaml

@@ -0,0 +1,27 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: |
+      Show metadata for a Dataproc Metastore location.
+    description: |
+      Display all metadata associated with a Metastore location given a valid
+      location name.
+    examples: |
+      To display the metadata for a location named `us-central1` in the default project,
+      run:
+
+        $ {command} us-central1
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:location
+      help_text: |
+        Dataproc Metastore location to describe.
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: metastore.projects.locations

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/locations/list.yaml

@@ -0,0 +1,36 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: |
+      List Dataproc Metastore locations.
+    description: |
+      List all Metastore locations.
+    examples: |
+      To list all the locations where you can create Dataproc Metastore
+      services, run:
+
+        $ {command}
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:project
+      help_text: |
+        The parent project of the locations you want to list.
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: metastore.projects.locations
+
+  response:
+    id_field: name
+
+  output:
+    format: |
+     table(
+        name.basename():label=LOCATION_NAME,
+        name.segment(1):label=PROJECT
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/operations/__init__.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2020 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for Dataproc Metastore operations."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+class Operations(base.Group):
+  """Manage Dataproc Metastore operations."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/operations/cancel.py

@@ -0,0 +1,73 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command to cancel an operation."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from apitools.base.py import exceptions as apitools_exceptions
+from googlecloudsdk.api_lib.metastore import operations_util as operations_api_util
+from googlecloudsdk.api_lib.metastore import util as api_util
+from googlecloudsdk.api_lib.util import exceptions
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.metastore import resource_args
+from googlecloudsdk.core import log
+from googlecloudsdk.core.console import console_io
+
+
+DETAILED_HELP = {'EXAMPLES': """\
+          To cancel an active Dataproc Metastore operation with the name
+          `operation-1` in location `us-central1`, run:
+
+          $ {command} operation-1 --location=us-central1
+        """}
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+class Cancel(base.Command):
+  """Cancel a Dataproc Metastore operation."""
+
+  detailed_help = DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddOperationResourceArg(parser, 'cancel')
+
+  def Run(self, args):
+    operation_ref = args.CONCEPTS.operation.Parse()
+
+    console_io.PromptContinue(
+        message='Cancel the following operation: [%s] in [%s].\n'
+        % (operation_ref.operationsId, operation_ref.locationsId),
+        cancel_on_no=True,
+        cancel_string='Cancellation aborted by user.',
+        throw_if_unattended=True,
+    )
+
+    try:
+      operations_api_util.Cancel(
+          operation_ref.RelativeName(), release_track=self.ReleaseTrack()
+      )
+      log.status.Print('Cancelled operation [{0}].'.format(args.operation))
+    except apitools_exceptions.HttpError as e:
+      exc = exceptions.HttpException(e)
+      log.status.Print(
+          'ERROR: Failed to cancel operation [{0}]: {1}.'.format(
+              args.operation, exc.payload.status_message
+          )
+      )
+      raise api_util.Error('Cancellation did not succeed.')

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/operations/delete.py

@@ -0,0 +1,89 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2020 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command to delete an operation."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from apitools.base.py import exceptions as apitools_exceptions
+
+from googlecloudsdk.api_lib.metastore import operations_util as operations_api_util
+from googlecloudsdk.api_lib.metastore import util as api_util
+from googlecloudsdk.api_lib.util import exceptions
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.metastore import resource_args
+from googlecloudsdk.command_lib.metastore import util as command_util
+from googlecloudsdk.core import log
+from googlecloudsdk.core.console import console_io
+
+
+DETAILED_HELP = {
+    'EXAMPLES':
+        """\
+          To delete a Dataproc Metastore operation with the name
+          `operation-1` in location `us-central1`, run:
+
+          $ {command} operation-1 --location=us-central1
+
+          To delete multiple Dataproc Metastore services with the name
+          `operation-1` and `operation-2` in the same location
+          `us-central1`, run:
+
+          $ {command} operation-1 operation-2 --location=us-central1
+        """
+}
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+class Delete(base.DeleteCommand):
+  """Delete one or more completed Dataproc Metastore operations."""
+
+  detailed_help = DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddOperationResourceArg(parser, 'to delete', plural=True)
+
+  def Run(self, args):
+    op_refs = args.CONCEPTS.operations.Parse()
+
+    console_io.PromptContinue(
+        message=command_util.ConstructList(
+            'Deleting the following operations:', [
+                '[%s] in [%s]' % (op_ref.operationsId, op_ref.locationsId)
+                for op_ref in op_refs
+            ]),
+        cancel_on_no=True,
+        cancel_string='Deletion aborted by user.',
+        throw_if_unattended=True)
+
+    encountered_errors = False
+    for op_ref in op_refs:
+      try:
+        operations_api_util.Delete(
+            op_ref.RelativeName(), release_track=self.ReleaseTrack())
+        failed = None
+      except apitools_exceptions.HttpError as e:
+        exc = exceptions.HttpException(e)
+        failed = exc.payload.status_message
+        encountered_errors = True
+
+      log.DeletedResource(
+          op_ref.RelativeName(), kind='operation', failed=failed)
+
+    if encountered_errors:
+      raise api_util.Error('Some deletions did not succeed.')

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/operations/describe.yaml

@@ -0,0 +1,28 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: |
+      Show metadata for a Dataproc Metastore operation.
+    description: |
+      Display all metadata associated with a Metastore operation given a valid
+      operation name.
+    examples: |
+      To display the metadata for an operation named `my-operation` in the default region,
+      run:
+
+        $ {command} my-operation
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:operation
+      help_text: |
+        Arguments and flags that specify the Dataproc Metastore operation you
+        want to describe.
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: metastore.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/operations/list.yaml

@@ -0,0 +1,48 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: |
+      List Dataproc Metastore operations.
+    description: |
+      List all Metastore operations under the specified location.
+
+      To specify the maximum number of operations to list, use the --limit flag.
+    examples: |
+      To list up to five operations in location
+      `us-central1`, run:
+
+        $ {command} --location=us-central1 --limit=5
+
+      To list all operations in all locations,
+      run:
+
+        $ {command} --location=-
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:location
+      help_text: |
+        The location of the operations to display.
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: metastore.projects.locations.operations
+
+  response:
+    id_field: name
+
+  output:
+    format: |
+     table(
+        name.basename():label=OPERATION_NAME,
+        name.segment(3):label=LOCATION,
+        metadata.verb:label=TYPE,
+        metadata.target.basename(),
+        done,
+        metadata.createTime.date():sort=1,
+        duration(start=metadata.createTime,end=metadata.endTime,precision=0,calendar=false).slice(2:).join("").yesno(no="<1S"):label=DURATION
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/operations/wait.yaml

@@ -0,0 +1,29 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: Poll a long-running Dataproc Metastore operation until it completes.
+    description: |
+      Poll a long-running Dataproc Metastore operation until it completes. When
+      the operation is complete, this command will display the results of the
+      operation.
+    examples: |
+      To poll a long-running Dataproc Metastore operation named 'my-operation' until it completes, run the following:
+
+        $ {command} my-operation
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: metastore.projects.locations.operations
+
+  arguments:
+    resource:
+      help_text: ID for the operation to poll until complete.
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:operation
+
+  async:
+    collection: metastore.projects.locations.operations
+    result_attribute: response

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/__init__.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2020 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for Dataproc Metastore services."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+class Services(base.Group):
+  """Manage Dataproc Metastore services."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/add_iam_policy_binding.yaml

@@ -0,0 +1,32 @@
+release_tracks: [ALPHA, BETA, GA]
+help_text:
+  brief: Add an IAM policy binding to a service.
+  description: |
+    Add an IAM policy binding to a service.
+
+  examples: |
+    To add an IAM policy binding for the role of 'roles/metastore.admin' for the user
+    'test-user@gmail.com', run:
+
+      $ {command} my-service --member='user:test-user@gmail.com' --role='roles/metastore.admin'
+
+    See https://cloud.google.com/dataproc-metastore/docs/iam-and-access-control for details of
+    policy role and member types.
+
+request:
+  collection: metastore.projects.locations.services
+  ALPHA:
+    api_version: v1alpha
+  BETA:
+    api_version: v1beta
+  GA:
+    api_version: v1
+
+iam:
+  enable_condition: false
+  policy_version: 0
+
+arguments:
+  resource:
+    help_text: Service for which to add the IAM policy to.
+    spec: !REF googlecloudsdk.command_lib.metastore.resources:service

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/alter_metadata_resource_location.yaml

@@ -0,0 +1,54 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: |
+      Alter metadata resource location.
+    description: |
+      Alter metadata resource location from a Dataproc Metastore service's underlying metadata store.
+
+      If run asynchronously with `--async`, exits after printing
+      one operation name that can be used to poll the status of the
+      creation via:
+
+        {top_command} metastore operations describe
+    examples: |
+      To alter metadata resource location with the resource_name
+      `databases/{database_id}`
+      or
+      `databases/{database_id}/tables/{table_id}`
+      or
+      and location_uri in location `us-central`, run:
+
+          $ {command} my-metastore-service --location=us-central1 --resource_name=databases/my-db
+            --location_uri=gs://destination_bucket/destination_object
+  request:
+    method: alterLocation
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: metastore.projects.locations.services
+  arguments:
+    resource:
+      help_text: |
+        Arguments and flags that specify the resource and the location you want to alter.
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:service
+    params:
+    - arg_name: resource_name
+      api_field: alterMetadataResourceLocationRequest.resourceName
+      help_text: |
+        The relative metadata resource name in the following format.
+         `databases/{database_id}`
+         or
+         `databases/{database_id}/tables/{table_id}`
+         or
+         `databases/{database_id}/tables/{table_id}/partitions/{partition_id}`
+      required: true
+    - arg_name: location_uri
+      api_field: alterMetadataResourceLocationRequest.locationUri
+      help_text: |
+        The new location URI for the metadata resource.
+      required: true
+  async:
+    collection: metastore.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/alter_table_properties.yaml

@@ -0,0 +1,101 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: |
+      Alter metadata table properties.
+    description: |
+      Alter metadata table properties from a Dataproc Metastore service's underlying metadata store.
+
+      If run asynchronously with `--async`, exits after printing
+      one operation name that can be used to poll the status of the
+      creation via:
+
+        {top_command} metastore operations describe
+    examples: |
+      To alter metadata table properties a and b on table-name
+      `databases/{database_id}/tables/{table_id}`
+      , use the update-mask `properties.a,properties.b`
+      , and run:
+
+          $ {command} my-metastore-service --location=us-central1
+            --table-name=databases/my-database/tables/my-table
+            --update-mask=properties.a,properties.b
+            --properties=a=1,b=2
+  request:
+    method: alterTableProperties
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: metastore.projects.locations.services
+  arguments:
+    resource:
+      help_text: |
+        Arguments and flags that specify the table you want to alter.
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:service
+    params:
+    - arg_name: table-name
+      api_field: alterTablePropertiesRequest.tableName
+      help_text: |
+        The name of the table containing the properties you're altering in the
+        following format.
+
+        `databases/{database_id}/tables/{table_id}`
+      required: true
+    - arg_name: update-mask
+      api_field: alterTablePropertiesRequest.updateMask
+      help_text: |
+        A string where field names are separated by a comma. Specifies the metadata table properties
+         fields that are overwritten by the update. Fields specified in the `update-mask` are
+          relative to the resource (not to the full request). A field is overwritten if it is in
+          the mask.
+
+        For example, given the target properties:
+
+            properties {
+              a: 1
+              b: 2
+            }
+
+        And an update properties:
+
+            properties {
+              a: 2
+              b: 3
+              c: 4
+            }
+
+        then if the field mask is:
+
+        `properties.b,properties.c`
+
+        then the updated result will be:
+
+            properties {
+              a: 1
+              b: 3
+              c: 4
+            }
+      required: true
+    - arg_name: properties
+      api_field: alterTablePropertiesRequest.properties.additionalProperties
+      help_text: |
+         A string where field names are separated by a comma. Describes the desired values to mutate.
+         If update-mask is empty, the properties will not update. Otherwise, the properties only
+         alter the values whose associated paths exist in the update mask.
+
+         For example, the desired key-value pairs.
+
+         a=2,b=3,c=4
+
+      required: true
+      metavar: KEY=VALUE
+      type:
+        arg_dict:
+          flatten: true
+          spec:
+          - api_field: key
+          - api_field: value
+  async:
+    collection: metastore.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/backups/__init__.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for backups under Dataproc Metastore services."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+class Backups(base.Group):
+  """Manage backups under Dataproc Metastore services."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/backups/add_iam_policy_binding.yaml

@@ -0,0 +1,32 @@
+release_tracks: [ALPHA, BETA, GA]
+help_text:
+  brief: Add an IAM policy binding to a backup.
+  description: |
+    Add an IAM policy binding to a backup.
+
+  examples: |
+    To add an IAM policy binding for the role of 'roles/metastore.admin' for the user
+    'test-user@gmail.com', run:
+
+      $ {command} my-backup --member='user:test-user@gmail.com' --role='roles/metastore.admin'
+
+    See https://cloud.google.com/dataproc-metastore/docs/iam-and-access-control for details of
+    policy role and member types.
+
+request:
+  collection: metastore.projects.locations.services.backups
+  ALPHA:
+    api_version: v1alpha
+  BETA:
+    api_version: v1beta
+  GA:
+    api_version: v1
+
+iam:
+  enable_condition: false
+  policy_version: 0
+
+arguments:
+  resource:
+    help_text: Backup for which to add the IAM policy to.
+    spec: !REF googlecloudsdk.command_lib.metastore.resources:backup

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/backups/create.yaml

@@ -0,0 +1,36 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: |
+      Backup a service.
+    description: |
+      Backup metadata and the resource configuration of a service.
+
+    examples: |
+      To make a backup named `my-backup` and description `test description`
+      of the service `my-service`, run:
+
+          $ {command} my-backup --service=my-service --description='test description'
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: metastore.projects.locations.services.backups
+
+  arguments:
+    resource:
+      help_text: |
+        Arguments and flags that specify the backup
+        you want to create.
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:backup
+    params:
+    - arg_name: description
+      api_field: backup.description
+      help_text: |
+        The description of this backup.
+
+  async:
+    collection: metastore.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/backups/delete.yaml

@@ -0,0 +1,34 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: |
+      Delete a service backup.
+    description: |
+      Delete a backup.
+
+      If run asynchronously with `--async`, exits after printing
+      an operation name that can be used to poll the status of the
+      deletion via:
+
+        {top_command} metastore operations describe
+    examples: |
+      To delete a backup named `my-backup` from the service `my-service`, run:
+
+          $ {command} my-backup --service=my-service
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: metastore.projects.locations.services.backups
+    method: delete
+
+  arguments:
+    resource:
+      help_text: Backup to delete.
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:backup
+
+  async:
+    collection: metastore.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/backups/describe.yaml

@@ -0,0 +1,29 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: |
+      Describe a backup.
+    description: |
+      Describe a backup.
+
+      Displays all details of a backup given a valid backup ID.
+    examples: |
+      To describe a backup with the ID
+      `my-backup` under service `my-service`, run:
+
+        $ {command} my-backup --service=my-service
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: metastore.projects.locations.services.backups
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:backup
+      help_text: |
+        Arguments and flags that specify the backup you want
+        to describe.

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/backups/get_iam_policy.yaml

@@ -0,0 +1,34 @@
+release_tracks: [ALPHA, BETA, GA]
+help_text:
+  brief: Get the IAM policy for the backup.
+  description: |
+    `{command}` displays the IAM policy associated with the backup.
+    If formatted as JSON, the output can be edited and used as a
+    policy file for set-iam-policy. The output includes an "etag" field
+    identifying the version emitted and allowing detection of
+    concurrent policy updates. The "etag" field should be removed to be
+    used as set-iam-policy input; see `{parent_command} set-iam-policy`
+    for additional details.
+  examples: |
+    To print the IAM policy for a given backup, run:
+
+      $ {command} my-backup
+
+request:
+  collection: metastore.projects.locations.services.backups
+  ALPHA:
+    api_version: v1alpha
+  BETA:
+    api_version: v1beta
+  GA:
+    api_version: v1
+
+iam:
+  enable_condition: false
+  policy_version: 0
+  get_iam_policy_version_path: options_requestedPolicyVersion
+
+arguments:
+  resource:
+    help_text: Backup for which to display the IAM policy.
+    spec: !REF googlecloudsdk.command_lib.metastore.resources:backup

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/backups/list.yaml

@@ -0,0 +1,41 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: |
+      List backups under a Dataproc Metastore service.
+    description: |
+      Lists all backups under the specified Dataproc Metastore service.
+    examples: |
+      To list all backups under service
+      `my-service`, run:
+
+        $ {command} --service=my-service
+
+      To list all backups under all services and
+      all locations, run:
+
+        $ {command} --service=- --location=-
+
+  arguments:
+    resource:
+      help_text: The service to list the backups for.
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:service
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: metastore.projects.locations.services.backups
+
+  response:
+    id_field: name
+
+  output:
+    format: |
+      table(
+        name.basename():label=NAME,
+        state:label=STATE,
+        createTime.date()
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/backups/remove_iam_policy_binding.yaml

@@ -0,0 +1,32 @@
+release_tracks: [ALPHA, BETA, GA]
+help_text:
+  brief: Remove an IAM policy binding from a backup.
+  description: |
+    Remove an IAM policy binding from a backup.
+
+  examples: |
+    To remove an IAM policy binding for the role of 'roles/metastore.admin' for the user
+    'test-user@gmail.com', run:
+
+      $ {command} my-backup --member='user:test-user@gmail.com' --role='roles/metastore.admin'
+
+    See https://cloud.google.com/iam/docs/managing-policies for details of
+    policy role and member types.
+
+request:
+  collection: metastore.projects.locations.services.backups
+  ALPHA:
+    api_version: v1alpha
+  BETA:
+    api_version: v1beta
+  GA:
+    api_version: v1
+
+iam:
+  enable_condition: false
+  policy_version: 0
+
+arguments:
+  resource:
+    help_text: Backup for which to remove the IAM policy from.
+    spec: !REF googlecloudsdk.command_lib.metastore.resources:backup

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/backups/set_iam_policy.yaml

@@ -0,0 +1,33 @@
+release_tracks: [ALPHA, BETA, GA]
+help_text:
+  brief: Set the IAM policy for a backup.
+  description: |
+    Sets the IAM policy for the given backup as defined in a JSON or YAML file.
+
+    See https://cloud.google.com/iam/docs/managing-policies for details of
+    the policy file format and contents.
+
+  examples: |
+    The following command will read an IAM policy defined in a JSON file
+    'policy.json' and set it for the backup 'my-backup':
+
+    $ {command} my-backup policy.json
+
+request:
+  collection: metastore.projects.locations.services.backups
+  ALPHA:
+    api_version: v1alpha
+  BETA:
+    api_version: v1beta
+  GA:
+    api_version: v1
+
+iam:
+  enable_condition: false
+  policy_version: 0
+  get_iam_policy_version_path: options.requestedPolicyVersion
+
+arguments:
+  resource:
+    help_text: Backup for which to display the IAM policy.
+    spec: !REF googlecloudsdk.command_lib.metastore.resources:backup

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/create.yaml

@@ -0,0 +1,529 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: |
+      Create a Dataproc Metastore service.
+    description: |
+      Create a new Dataproc Metastore service with the given name and configurations.
+
+      If run asynchronously with `--async`, exits after printing
+      one operation name that can be used to poll the status of the
+      creation via:
+
+        {top_command} metastore operations describe
+    examples: |
+      To create a Dataproc Metastore service with the name `my-metastore-service` in location
+      `us-central` using a non default port 9090, run:
+
+          $ {command} my-metastore-service --location=us-central1 --port=9090
+
+      To create a Dataproc Metastore service with the name `my-metastore-service` in location
+      `us-central` using a non default network foo, run:
+
+          $ {command} my-metastore-service --location=us-central1 --network=foo
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+      modify_request_hooks:
+      - googlecloudsdk.command_lib.metastore.services.util:UpdateScalingConfigForCreate
+      - googlecloudsdk.command_lib.metastore.services.util:GenerateNetworkConfigFromSubnetList
+      - googlecloudsdk.command_lib.metastore.services.util:GenerateAuxiliaryVersionsConfigFromList
+      - googlecloudsdk.command_lib.metastore.validators:ValidateServiceMutexConfig
+      - googlecloudsdk.command_lib.metastore.validators:ValidateScheduledBackupConfigs
+      - googlecloudsdk.command_lib.metastore.validators:ValidateKmsKeys
+    BETA:
+      api_version: v1beta
+      modify_request_hooks:
+      - googlecloudsdk.command_lib.metastore.services.util:UpdateScalingConfigForCreate
+      - googlecloudsdk.command_lib.metastore.services.util:GenerateNetworkConfigFromSubnetList
+      - googlecloudsdk.command_lib.metastore.services.util:GenerateAuxiliaryVersionsConfigFromList
+      - googlecloudsdk.command_lib.metastore.validators:ValidateServiceMutexConfig
+      - googlecloudsdk.command_lib.metastore.validators:ValidateScheduledBackupConfigs
+      - googlecloudsdk.command_lib.metastore.validators:ValidateKmsKeys
+    GA:
+      api_version: v1
+      modify_request_hooks:
+      - googlecloudsdk.command_lib.metastore.services.util:UpdateScalingConfigForCreate
+      - googlecloudsdk.command_lib.metastore.services.util:GenerateNetworkConfigFromSubnetList
+      - googlecloudsdk.command_lib.metastore.services.util:GenerateAuxiliaryVersionsConfigFromList
+      - googlecloudsdk.command_lib.metastore.validators:ValidateServiceMutexConfigForV1
+    collection: metastore.projects.locations.services
+
+  arguments:
+    resource:
+      help_text: |
+        Arguments and flags that specify the Dataproc Metastore service
+        you want to create.
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:service
+    params:
+    - arg_name: port
+      api_field: service.port
+      default: 9083
+      processor: googlecloudsdk.command_lib.metastore.validators:ValidatePort
+      help_text: |
+        The TCP port on which the Metastore service will listen.
+        If unspecified, the default port 9083 will be used.
+    - group:
+        help_text: |
+          The instance size of the Dataproc Metastore instance.
+        mutex: true
+        params:
+        - arg_name: tier
+          api_field: service.tier
+          help_text: |
+            The tier of the service.
+          choices:
+          - arg_value: enterprise
+            enum_value: ENTERPRISE
+            help_text:  |
+              The enterprise tier provides multi-zone high availability, and sufficient
+              scalability for enterprise-level Dataproc Metastore workloads.
+          - arg_value: developer
+            enum_value: DEVELOPER
+            help_text:  |
+              The developer tier provides limited scalability and no fault tolerance.
+              Good for low-cost proof-of-concept.
+          fallback: googlecloudsdk.core.properties:VALUES.metastore.tier.Get
+        - arg_name: scaling-factor
+          api_field: service.scalingConfig.scalingFactor
+          help_text: |
+            The scaling factor of the service.
+            Can be one of [0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 1.0, 2.0, 3.0, 4.0, 5.0, 6.0].
+          processor: googlecloudsdk.command_lib.metastore.validators:ValidateScalingFactor
+        - arg_name: instance-size
+          api_field: service.scalingConfig.instanceSize
+          help_text: |
+            The instance size of the service.
+          choices:
+          - arg_value: extra-small
+            enum_value: EXTRA_SMALL
+            help_text:  |
+              Extra small instance size, maps to a scaling factor of 0.1.
+          - arg_value: small
+            enum_value: SMALL
+            help_text:  |
+              Small instance size, maps to a scaling factor of 0.5.
+          - arg_value: medium
+            enum_value: MEDIUM
+            help_text:  |
+              Medium instance size, maps to a scaling factor of 1.0.
+          - arg_value: large
+            enum_value: LARGE
+            help_text:  |
+              Large instance size, maps to a scaling factor of 3.0.
+          - arg_value: extra-large
+            enum_value: EXTRA_LARGE
+            help_text:  |
+              Extra large instance size, maps to a scaling factor of 6.0.
+        - group:
+            help_text: |
+              The autoscaling configuration of the Dataproc Metastore instance.
+            params:
+            - arg_name: min-scaling-factor
+              api_field: service.scalingConfig.autoscalingConfig.limitConfig.minScalingFactor
+              help_text: |
+                The minimum scaling factor allowed by the autoscaler.
+                Can be one of [0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 1.0, 2.0, 3.0, 4.0, 5.0, 6.0].
+                The default value is 0.1.
+              processor: googlecloudsdk.command_lib.metastore.validators:ValidateMinScalingFactor
+            - arg_name: max-scaling-factor
+              api_field: service.scalingConfig.autoscalingConfig.limitConfig.maxScalingFactor
+              help_text: |
+                The maximum scaling factor allowed by the autoscaler.
+                Can be one of [0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 1.0, 2.0, 3.0, 4.0, 5.0, 6.0].
+                The default value is 6.0.
+              processor: googlecloudsdk.command_lib.metastore.validators:ValidateMaxScalingFactor
+    - arg_name: autoscaling-enabled
+      api_field: service.scalingConfig.autoscalingConfig.autoscalingEnabled
+      help_text: |
+        A boolean flag to determine whether Dataproc Metastore autoscaling should be enabled,
+        false if unspecified.
+
+        The default minimum and maximum scaling factors are 0.1 and 6.0, respectively.
+
+        The minimum and maximum scaling factors can be specified using --min-scaling-factor and
+        --max-scaling-factor.
+    - arg_name: hive-metastore-version
+      api_field: service.hiveMetastoreConfig.version
+      help_text: |
+        The Hive metastore schema version. The supported versions of a location are listed via:
+
+          {top_command} metastore locations describe
+
+        If unspecified, the default version chosen by the server will be used.
+    - arg_name: data-catalog-sync
+      default: false
+      api_field: service.metadataIntegration.dataCatalogConfig.enabled
+      help_text: |
+        A boolean flag to determine whether Dataproc Metastore metadata sync
+        to Data Catalog should be enabled, false if unspecified.
+        Mutually exclusive with flag `--encryption-kms-key`.
+    - arg_name: deletion-protection
+      type: bool
+      api_field: service.deletionProtection
+      help_text: |
+        Flag that enables delete protection on Dataproc Metastore instance to prevent
+        accidental deletions of the instance.
+        Use --deletion-protection to enable.
+    - arg_name: release-channel
+      help_text: |
+        The release channel of the service.
+      choices:
+      - arg_value: stable
+        enum_value: STABLE
+        help_text:  |
+          The `STABLE` release channel contains features that are considered stable
+          and have been validated for production use.
+      - arg_value: canary
+        enum_value: CANARY
+        help_text:  |
+          The `CANARY` release channel contains the newest features, which may be
+          unstable and subject to unresolved issues with no known workarounds.
+          Services using the `CANARY` release channel are not subject to any SLAs.
+      default: stable
+      api_field: service.releaseChannel
+    - arg_name: database-type
+      help_text: |
+        The type of database the Dataproc Metastore service will store data in.
+      choices:
+      - arg_value: mysql
+        enum_value: MYSQL
+        help_text:  |
+          `MYSQL` database type is a Dataproc Metastore service backed by MySQL CloudSQL.
+      - arg_value: spanner
+        enum_value: SPANNER
+        help_text:  |
+          `SPANNER` database type is a Dataproc Metastore service backed by Cloud Spanner.
+      default: mysql
+      api_field: service.databaseType
+    - group:
+        help_text: |
+          Configuration properties specific to running Hive metastore
+          software as the metastore service.
+        mutex: true
+        params:
+        - arg_name: hive-metastore-configs
+          api_field: service.hiveMetastoreConfig.configOverrides.additionalProperties
+          metavar: KEY=VALUE
+          help_text: |
+            A mapping of Hive metastore configuration key-value pairs to
+            apply to the Hive metastore.
+          type:
+            arg_dict:
+              flatten: true
+              spec:
+              - api_field: key
+              - api_field: value
+        - arg_name: hive-metastore-configs-from-file
+          api_field: service.hiveMetastoreConfig.configOverrides
+          type: "googlecloudsdk.calliope.arg_parsers:FileContents:"
+          processor: googlecloudsdk.command_lib.metastore.services.util:LoadHiveMetatsoreConfigsFromXmlFile
+          help_text: |
+            Path to a XML file containing a mapping of Hive metastore configuration key-value
+            pairs to apply to the Hive metastore.
+
+            For example:
+
+              hive-site.xml
+                  <configuration>
+                    <property>
+                      <name>hive.metastore.warehouse.dir</name>
+                      <value>${test.warehouse.dir}</value>
+                      <description></description>
+                    </property>
+                  </configuration>
+    - group:
+        help_text: |
+          Information used to configure the Hive metastore service as a service principal
+          in a Kerberos realm.
+        params:
+        - arg_name: kerberos-principal
+          api_field: service.hiveMetastoreConfig.kerberosConfig.principal
+          processor: googlecloudsdk.command_lib.metastore.validators:ValidateKerberosPrincipal
+          help_text: |
+            A Kerberos principal that exists in the KDC to authenticate as. A typical principal
+            is of the form "primary/instance@REALM", but there is no exact format.
+          required: true
+        - arg_name: krb5-config
+          api_field: service.hiveMetastoreConfig.kerberosConfig.krb5ConfigGcsUri
+          processor: googlecloudsdk.command_lib.metastore.validators:ValidateGcsUri:arg_name=--krb5-config
+          help_text: |
+            A Cloud Storage URI that specifies the path to a krb5.conf file. It is of the form
+            gs://{bucket_name}/path/krb5.conf, although the file does not need to be named
+            krb5.conf explicitly.
+          required: true
+        - arg_name: keytab
+          api_field: service.hiveMetastoreConfig.kerberosConfig.keytab.cloudSecret
+          processor: googlecloudsdk.command_lib.metastore.parsers:ParseSecretManagerSecretVersion
+          help_text: |
+            A Kerberos keytab file that can be used to authenticate a service principal
+            with a Kerberos Key Distribution Center. This is a Secret Manager secret version,
+            and can be fully-qualified URL, or relative name in the form
+            `projects/{project_id}/secrets/{secret_id}/versions/{version_id}`.
+          required: true
+    - group:
+        help_text: |
+          The one hour maintenance window that specifies when Dataproc
+          Metastore may perform system maintenance operation to the service, in
+          UTC time.
+        params:
+        - arg_name: maintenance-window-day
+          api_field: service.maintenanceWindow.dayOfWeek
+          required: true
+          choices:
+          - arg_value: mon
+            enum_value: MONDAY
+          - arg_value: tue
+            enum_value: TUESDAY
+          - arg_value: wed
+            enum_value: WEDNESDAY
+          - arg_value: thu
+            enum_value: THURSDAY
+          - arg_value: fri
+            enum_value: FRIDAY
+          - arg_value: sat
+            enum_value: SATURDAY
+          - arg_value: sun
+            enum_value: SUNDAY
+          help_text: |
+            The day of week when the window starts, e.g., `sun`.
+        - arg_name: maintenance-window-hour
+          api_field: service.maintenanceWindow.hourOfDay
+          required: true
+          processor: googlecloudsdk.command_lib.metastore.validators:ValidateHourOfDay
+          help_text: |
+            The hour of day (0-23) when the window starts.
+    - group:
+        help_text: |
+          Encryption configuration for the metastore service.
+        mutex: true
+        params:
+        - arg_name: encryption-kms-keys
+          release_tracks: [ALPHA, BETA]
+          api_field: service.encryptionConfig.kmsKeys
+          help_text: |
+            Comma-separated list of the Cloud KMS keys to use for customer data encryption.
+            Cannot be changed once the service is created.
+            Mutually exclusive with flag `--data-catalog-sync` and `--encryption-kms-key`.
+            Each key can be provided as a fully-qualified URL, or a relative name in
+            the form `projects/{project_id}/locations/{location}/keyRings/{key_ring_id}/cryptoKeys/{crypto_key_id}`.
+          type: "arg_list"
+        - arg_name: encryption-kms-key
+          api_field: service.encryptionConfig.kmsKey
+          processor: googlecloudsdk.command_lib.metastore.parsers:ParseCloudKmsKey
+          help_text: |
+            The name of the Cloud KMS key to use for customer data encryption.
+            Cannot be changed once the service is created.
+            Mutually exclusive with flag `--data-catalog-sync`.
+            This can be provided as a fully-qualified URL, or a relative name in
+            the form `projects/{project_id}/locations/{location}/keyRings/{key_ring_id}/cryptoKeys/{crypto_key_id}`.
+    - group:
+        help_text: |
+          Network configuration for the metastore service.
+        mutex: true
+        params:
+        - arg_name: network
+          api_field: service.network
+          processor: googlecloudsdk.command_lib.metastore.parsers:ParseNetwork
+          help_text: |
+            The name of the network on which the service can be accessed.
+            This can be the network's ID, fully-qualified URL, or relative name in
+            the form `projects/{project_id}/global/networks/{network}`.
+            If "network", "consumer-subnetworks" and "network-config" are unspecified,
+            the "default" network will be used.
+        - arg_name: consumer-subnetworks
+          help_text: |
+            The list of subnetworks from which the service can be accessed.
+            This can be the subnetwork's ID, fully-qualified URL, or relative name in
+            the form `projects/{project_id}/regions/{region_id}/subnetworks/{subnetwork}`.
+          type: "arg_list"
+        - arg_name: network-config-from-file
+          api_field: service.networkConfig
+          type: "googlecloudsdk.calliope.arg_parsers:YAMLFileContents:"
+          help_text: |
+            Path to a YAML file containing the network configuration for Dataproc Metastore instance.
+            The contents of the file should be structured as follows:
+
+            YAML:
+            consumers:
+            - subnetwork: projects/{project_id}/regions/{region_id}/subnetworks/{subnetwork_id}
+            - subnetwork: projects/{project_id}/regions/{region_id}/subnetworks/{subnetwork_id}
+            ...
+    - group:
+        help_text: |
+          Auxiliary versions configuration for the Dataproc Metastore service. When specified,
+          a secondary Hive metastore service is created along with the primary service.
+        mutex: true
+        params:
+        - arg_name: auxiliary-versions
+          type: "arg_list"
+          help_text: |
+            Comma-separated list of auxiliary Hive metastore versions to deploy. Auxiliary Hive
+            metastore versions must be less than the primary Hive metastore service's version.
+        - arg_name: auxiliary-versions-from-file
+          api_field: service.hiveMetastoreConfig.auxiliaryVersions
+          type: "googlecloudsdk.calliope.arg_parsers:YAMLFileContents:"
+          processor: googlecloudsdk.command_lib.metastore.services.util:LoadAuxiliaryVersionsConfigsFromYamlFile
+          help_text: |
+            Path to a YAML file containing the auxiliary versions configuration for
+            Dataproc Metastore instance. The file should contain a unique auxiliary service name and
+            auxiliary version that is lower than the primary service version. The primary version's
+            Hive metastore configs are applied to the auxiliary version. Additional Hive metastore
+            configs can be specified for the auxiliary version using "config_overrides". If a
+            specified config property has already been overridden in the primary Hive metastore
+            version's configs, the auxiliary version's override takes precedence.
+            The contents of the file should be structured as follows:
+
+            YAML:
+
+            ```
+              - name: aux-service1
+                version: x.y.z
+                config_overrides:
+                  key1: value1
+                  key2: value2
+                ...
+              - name: aux-service2
+                version: x.y.z
+                config_overrides:
+                  key1: value1
+                  key2: value2
+                ...
+              ...
+            ```
+    - arg_name: endpoint-protocol
+      help_text: |
+        The protocol to use for the metastore service endpoint.
+        If unspecified, defaults to `THRIFT`.
+      choices:
+      - arg_value: thrift
+        enum_value: THRIFT
+        help_text:  |
+          The legacy Apache `THRIFT` protocol.
+      - arg_value: grpc
+        enum_value: GRPC
+        help_text:  |
+          The modernized `GRPC` protocol.
+      default: thrift
+      api_field: service.hiveMetastoreConfig.endpointProtocol
+    - group:
+        release_tracks: [ALPHA, BETA]
+        help_text: |
+          Custom region configuration for the metastore service.
+        params:
+        - arg_name: read-write-regions
+          api_field: service.multiRegionConfig.customRegionConfig.readWriteRegions
+          help_text: |
+            The list of read-write regions where the metastore service runs in. These regions
+            should be part (or subset) of the multi-region.
+          type: "arg_list"
+        - arg_name: read-only-regions
+          api_field: service.multiRegionConfig.customRegionConfig.readOnlyRegions
+          help_text: |
+            The list of read-only regions where the metastore service runs in. These regions
+            should be part (or subset) of the multi-region.
+          type: "arg_list"
+    - group:
+        mutex: true
+        help_text: |
+          Scheduled backup configurations to enable a scheduled backup of the metastore service.
+        params:
+        - arg_name: scheduled-backup-configs-from-file
+          api_field: service.scheduledBackup
+          type: "googlecloudsdk.calliope.arg_parsers:FileContents:"
+          processor: googlecloudsdk.command_lib.metastore.services.util:LoadScheduledBackupConfigsFromJsonFile
+          help_text: |
+            Path to a JSON file containing a mapping of scheduled backup configurations key-value pairs to apply to the scheduled backup.
+
+            For example:
+
+              backup_configs.json
+                  {
+                    "enabled": true,
+                    "cron_schedule": "0 * * * *",
+                    "backup_location": "gs://example-bucket",
+                    "time_zone": "UTC"
+                  }
+        - group:
+            help_text: |
+              Scheduled backup configurations to enable a scheduled backup of the metastore service.
+            params:
+            - arg_name: enable-scheduled-backup
+              api_field: service.scheduledBackup.enabled
+              action: store_true
+              help_text: |
+                Enable or disable scheduled backups for the Metastore service.
+            - arg_name: scheduled-backup-cron
+              api_field: service.scheduledBackup.cronSchedule
+              help_text: |
+                Specify the frequency of a scheduled backup of the metastore service.
+            - arg_name: scheduled-backup-location
+              api_field: service.scheduledBackup.backupLocation
+              help_text: |
+                Set the Cloud Storage URI to store the scheduled backups of the metastore service.
+    - arg_name: tags
+      api_field: service.tags.additionalProperties
+      metavar: KEY=VALUE
+      help_text: |
+        List of tag KEY=VALUE pairs to add.
+      type:
+        arg_dict:
+          flatten: true
+          spec:
+          - api_field: key
+          - api_field: value
+    - group:
+        release_tracks: [ALPHA, BETA]
+        hidden: true
+        help_text: |
+          Configuration required for migrating to BigQuery Metastore service.
+        params:
+        - arg_name: bigquery-project-id
+          api_field: service.bigqueryMetastoreMigrationConfig.bigqueryProjectId
+          help_text: |
+            Project ID where the BigQuery resources (e.g. datasets, tables, etc.)
+            should be created.
+          required: true
+        - arg_name: bigquery-dataset-location
+          api_field: service.bigqueryMetastoreMigrationConfig.bigqueryDatasetLocation
+          help_text: |
+            The location where the BigQuery resources (e.g. datasets, tables, etc.)
+            should be created (e.g. us-central1, us, eu, etc.).
+          required: true
+        - arg_name: desired-migration-state
+          api_field: service.bigqueryMetastoreMigrationConfig.desiredMigrationState
+          help_text: |
+            The desired state of the migration. Note that this also reflects the
+            current state of the migration. If an attempt to update to a new desired
+            state fails, the migration will revert to the previous state.
+          choices:
+          - arg_value: migrate
+            enum_value: MIGRATE
+            help_text:  |
+              By setting the desired migration state to `MIGRATE`, metadata updates in
+              Dataproc Metastore will be replicated to the BigQuery Metastore service,
+              ensuring that it remains consistently synchronized with Dataproc
+              Metastore. Note that this includes initial backfill of existing metadata.
+          - arg_value: cutover
+            enum_value: CUTOVER
+            help_text:  |
+              By setting the desired migration state to `CUTOVER`, all metadata
+              requests are routed to BigQuery Metastore service and Dataproc Metastore
+              only functions as a proxy. This state can be considered as the completion
+              of the migration.
+          - arg_value: cancel
+            enum_value: CANCEL
+            help_text:  |
+              By setting the desired migration state to `CANCEL`, the migration is
+              effectively cancelled. If the previous migration state was `MIGRATE`,
+              then replication to BigQuery Metastore will be cancelled. If the previous
+              state was `CUTOVER`, then metadata requests will now be served from
+              Dataproc Metastore instead of BigQuery Metastore. Note that existing
+              metadata changes replicated to BigQuery Metastore service are not rolled
+              back.
+          required: true
+    labels:
+      api_field: service.labels
+
+  async:
+    collection: metastore.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/databases/__init__.py

@@ -0,0 +1,26 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for databases under Dataproc Metastore services."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA)
+class Databases(base.Group):
+  """Manage databases under Dataproc Metastore services."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/databases/add_iam_policy_binding.yaml

@@ -0,0 +1,30 @@
+release_tracks: [ALPHA, BETA]
+help_text:
+  brief: Add an IAM policy binding to a database.
+  description: |
+    Add an IAM policy binding to a database.
+
+  examples: |
+    To add an IAM policy binding for the role of 'roles/metastore.metadataOwner' for the user
+    'test-user@gmail.com', run:
+
+      $ {command} my-database --member='user:test-user@gmail.com' --role='roles/metastore.metadataOwner'
+
+    See https://cloud.google.com/dataproc-metastore/docs/iam-and-access-control for details of
+    policy role and member types.
+
+request:
+  collection: metastore.projects.locations.services.databases
+  ALPHA:
+    api_version: v1alpha
+  BETA:
+    api_version: v1beta
+
+iam:
+  enable_condition: false
+  policy_version: 0
+
+arguments:
+  resource:
+    help_text: Database for which to add the IAM policy to.
+    spec: !REF googlecloudsdk.command_lib.metastore.resources:database

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/databases/get_iam_policy.yaml

@@ -0,0 +1,32 @@
+release_tracks: [ALPHA, BETA]
+help_text:
+  brief: Get the IAM policy for the database.
+  description: |
+    `{command}` displays the IAM policy associated with the database.
+    If formatted as JSON, the output can be edited and used as a
+    policy file for set-iam-policy. The output includes an "etag" field
+    identifying the version emitted and allowing detection of
+    concurrent policy updates. The "etag" field should be removed to be
+    used as set-iam-policy input; see `{parent_command} set-iam-policy`
+    for additional details.
+  examples: |
+    To print the IAM policy for a given database, run:
+
+      $ {command} my-database
+
+request:
+  collection: metastore.projects.locations.services.databases
+  ALPHA:
+    api_version: v1alpha
+  BETA:
+    api_version: v1beta
+
+iam:
+  enable_condition: false
+  policy_version: 0
+  get_iam_policy_version_path: options_requestedPolicyVersion
+
+arguments:
+  resource:
+    help_text: Database for which to display the IAM policy.
+    spec: !REF googlecloudsdk.command_lib.metastore.resources:database

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/databases/remove_iam_policy_binding.yaml

@@ -0,0 +1,30 @@
+release_tracks: [ALPHA, BETA]
+help_text:
+  brief: Remove an IAM policy binding from a database.
+  description: |
+    Remove an IAM policy binding from a database.
+
+  examples: |
+    To remove an IAM policy binding for the role of 'roles/metastore.metadataOwner' for the user
+    'test-user@gmail.com', run:
+
+      $ {command} my-database --member='user:test-user@gmail.com' --role='roles/metastore.metadataOwner'
+
+    See https://cloud.google.com/iam/docs/managing-policies for details of
+    policy role and member types.
+
+request:
+  collection: metastore.projects.locations.services.databases
+  ALPHA:
+    api_version: v1alpha
+  BETA:
+    api_version: v1beta
+
+iam:
+  enable_condition: false
+  policy_version: 0
+
+arguments:
+  resource:
+    help_text: Database for which to remove the IAM policy from.
+    spec: !REF googlecloudsdk.command_lib.metastore.resources:database

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/databases/set_iam_policy.yaml

@@ -0,0 +1,31 @@
+release_tracks: [ALPHA, BETA]
+help_text:
+  brief: Set the IAM policy for a database.
+  description: |
+    Sets the IAM policy for the given database as defined in a JSON or YAML file.
+
+    See https://cloud.google.com/iam/docs/managing-policies for details of
+    the policy file format and contents.
+
+  examples: |
+    The following command will read an IAM policy defined in a JSON file
+    'policy.json' and set it for the database 'my-database':
+
+    $ {command} my-database policy.json
+
+request:
+  collection: metastore.projects.locations.services.databases
+  ALPHA:
+    api_version: v1alpha
+  BETA:
+    api_version: v1beta
+
+iam:
+  enable_condition: false
+  policy_version: 0
+  get_iam_policy_version_path: options.requestedPolicyVersion
+
+arguments:
+  resource:
+    help_text: Database for which to display the IAM policy.
+    spec: !REF googlecloudsdk.command_lib.metastore.resources:database

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/databases/tables/__init__.py

@@ -0,0 +1,26 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for tables under databases."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA)
+class Backups(base.Group):
+  """Manage tables under databases."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/databases/tables/add_iam_policy_binding.yaml

@@ -0,0 +1,30 @@
+release_tracks: [ALPHA, BETA]
+help_text:
+  brief: Add an IAM policy binding to a table.
+  description: |
+    Add an IAM policy binding to a table.
+
+  examples: |
+    To add an IAM policy binding for the role of 'roles/metastore.metadataOwner' for the user
+    'test-user@gmail.com', run:
+
+      $ {command} my-table --member='user:test-user@gmail.com' --role='roles/metastore.metadataOwner'
+
+    See https://cloud.google.com/dataproc-metastore/docs/iam-and-access-control for details of
+    policy role and member types.
+
+request:
+  collection: metastore.projects.locations.services.databases.tables
+  ALPHA:
+    api_version: v1alpha
+  BETA:
+    api_version: v1beta
+
+iam:
+  enable_condition: false
+  policy_version: 0
+
+arguments:
+  resource:
+    help_text: Table for which to add the IAM policy to.
+    spec: !REF googlecloudsdk.command_lib.metastore.resources:table

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/databases/tables/get_iam_policy.yaml

@@ -0,0 +1,32 @@
+release_tracks: [ALPHA, BETA]
+help_text:
+  brief: Get the IAM policy for the table.
+  description: |
+    `{command}` displays the IAM policy associated with the table.
+    If formatted as JSON, the output can be edited and used as a
+    policy file for set-iam-policy. The output includes an "etag" field
+    identifying the version emitted and allowing detection of
+    concurrent policy updates. The "etag" field should be removed to be
+    used as set-iam-policy input; see `{parent_command} set-iam-policy`
+    for additional details.
+  examples: |
+    To print the IAM policy for a given table, run:
+
+      $ {command} my-table
+
+request:
+  collection: metastore.projects.locations.services.databases.tables
+  ALPHA:
+    api_version: v1alpha
+  BETA:
+    api_version: v1beta
+
+iam:
+  enable_condition: false
+  policy_version: 0
+  get_iam_policy_version_path: options_requestedPolicyVersion
+
+arguments:
+  resource:
+    help_text: Table for which to display the IAM policy.
+    spec: !REF googlecloudsdk.command_lib.metastore.resources:table

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/databases/tables/remove_iam_policy_binding.yaml

@@ -0,0 +1,30 @@
+release_tracks: [ALPHA, BETA]
+help_text:
+  brief: Remove an IAM policy binding from a table.
+  description: |
+    Remove an IAM policy binding from a table.
+
+  examples: |
+    To remove an IAM policy binding for the role of 'roles/metastore.metadataOwner' for the user
+    'test-user@gmail.com', run:
+
+      $ {command} my-table --member='user:test-user@gmail.com' --role='roles/metastore.metadataOwner'
+
+    See https://cloud.google.com/iam/docs/managing-policies for details of
+    policy role and member types.
+
+request:
+  collection: metastore.projects.locations.services.databases.tables
+  ALPHA:
+    api_version: v1alpha
+  BETA:
+    api_version: v1beta
+
+iam:
+  enable_condition: false
+  policy_version: 0
+
+arguments:
+  resource:
+    help_text: Table for which to remove the IAM policy from.
+    spec: !REF googlecloudsdk.command_lib.metastore.resources:table

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/databases/tables/set_iam_policy.yaml

@@ -0,0 +1,31 @@
+release_tracks: [ALPHA, BETA]
+help_text:
+  brief: Set the IAM policy for a table.
+  description: |
+    Sets the IAM policy for the given table as defined in a JSON or YAML file.
+
+    See https://cloud.google.com/iam/docs/managing-policies for details of
+    the policy file format and contents.
+
+  examples: |
+    The following command will read an IAM policy defined in a JSON file
+    'policy.json' and set it for the table 'my-table':
+
+    $ {command} my-table policy.json
+
+request:
+  collection: metastore.projects.locations.services.databases.tables
+  ALPHA:
+    api_version: v1alpha
+  BETA:
+    api_version: v1beta
+
+iam:
+  enable_condition: false
+  policy_version: 0
+  get_iam_policy_version_path: options.requestedPolicyVersion
+
+arguments:
+  resource:
+    help_text: Table for which to display the IAM policy.
+    spec: !REF googlecloudsdk.command_lib.metastore.resources:table

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/delete.py

@@ -0,0 +1,112 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2020 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command to delete one or more Dataproc Metastore services."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+import json
+
+from apitools.base.py import exceptions as apitools_exceptions
+from googlecloudsdk.api_lib.metastore import services_util as services_api_util
+from googlecloudsdk.api_lib.metastore import util as api_util
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.metastore import delete_util
+from googlecloudsdk.command_lib.metastore import resource_args
+from googlecloudsdk.command_lib.metastore import util as command_util
+from googlecloudsdk.core import log
+from googlecloudsdk.core.console import console_io
+
+DETAILED_HELP = {
+    'EXAMPLES':
+        """\
+          To delete a Dataproc Metastore service with the name
+          `my-metastore-service` in location `us-central1`, run:
+
+          $ {command} my-metastore-service --location=us-central1
+
+          To delete multiple Dataproc Metastore services with the name
+          `service-1` and `service-2` in the same location
+          `us-central1`, run:
+
+          $ {command} service-1 service-2 --location=us-central1
+        """
+}
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+class Delete(base.DeleteCommand):
+  """Delete one or more Dataproc Metastore services.
+
+  If run asynchronously with `--async`, exits after printing
+  one or more operation names that can be used to poll the status of the
+  deletion(s) via:
+
+    {top_command} metastore operations describe
+  """
+
+  detailed_help = DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddServiceResourceArg(
+        parser, 'to delete', plural=True, required=True, positional=True)
+    base.ASYNC_FLAG.AddToParser(parser)
+
+  def Run(self, args):
+    env_refs = args.CONCEPTS.services.Parse()
+    console_io.PromptContinue(
+        message=command_util.ConstructList('Deleting the following services:', [
+            '[{}] in [{}]'.format(env_ref.servicesId, env_ref.locationsId)
+            for env_ref in env_refs
+        ]),
+        cancel_on_no=True,
+        cancel_string='Deletion aborted by user.',
+        throw_if_unattended=True)
+
+    waiter = delete_util.ServiceDeletionWaiter(
+        release_track=self.ReleaseTrack())
+    encountered_errors = False
+    for env_ref in env_refs:
+      operation = None
+      failed = None
+      try:
+        operation = services_api_util.Delete(
+            env_ref.RelativeName(), release_track=self.ReleaseTrack())
+      except apitools_exceptions.HttpError as e:
+        failed = json.loads(e.content)['error']['message']
+        encountered_errors = True
+      else:
+        details = 'with operation [{0}]'.format(operation.name)
+        waiter.AddPendingDelete(
+            service_name=env_ref.RelativeName(), operation=operation)
+      finally:
+        log.DeletedResource(
+            env_ref.RelativeName(),
+            kind='service',
+            is_async=True,
+            details=None if encountered_errors else
+            'with operation [{0}]'.format(operation.name),
+            failed=failed)
+
+    if not args.async_:
+      encountered_errors = waiter.Wait() or encountered_errors
+    if encountered_errors:
+      raise api_util.ServiceDeleteError(
+          'Some requested deletions did not succeed.')

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/describe.yaml

@@ -0,0 +1,29 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: |
+      Describe a Dataproc Metastore service.
+    description: |
+      Describe a Dataproc Metastore service.
+
+      Displays all details of a Dataproc Metastore service given a valid service ID.
+    examples: |
+      To describe a Dataproc Metastore service with the ID
+      `my-metastore-service` in `us-central1`, run:
+
+        $ {command} my-metastore-service --location=us-central1
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: metastore.projects.locations.services
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:service
+      help_text: |
+        Arguments and flags that specify the Metastore service you want
+        to describe.

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/export/__init__.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2020 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for metadata export of Dataproc Metastore services."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+class Export(base.Group):
+  """Export metadata from a Dataproc Metastore service."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/export/gcs.yaml

@@ -0,0 +1,60 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief:  |
+      Export metadata from a Dataproc Metastore service to Google Cloud Storage.
+    description: |
+      Export metadata from a Dataproc Metastore service to Google Cloud Storage.
+
+      If run asynchronously with `--async`, exits after printing
+      the operation name that can be used to poll the status of the
+      export via:
+
+        {top_command} metastore operations describe
+    examples: |
+        To export metadata from a Dataproc Metastore service with the name `my-metastore-service`
+        in location `us-central1` to the destination folder `gs://my-bucket/destination-folder`, run:
+
+          $ {command} my-metastore-service --location=us-central1 --destination-folder=gs://my-bucket/destination-folder
+
+  request:
+    method: exportMetadata
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: metastore.projects.locations.services
+
+  arguments:
+    resource:
+      help_text: |
+        Arguments and flags that specify the Dataproc Metastore service
+        you want to export.
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:service
+    params:
+    - arg_name: dump-type
+      api_field: exportMetadataRequest.databaseDumpType
+      help_text: |
+        The type of the database dump. If unspecified, defaults to `mysql`.
+      choices:
+      - arg_value: mysql
+        enum_value: MYSQL
+        help_text: |
+          Database dump is a MYSQL dump file.
+      - arg_value: avro
+        enum_value: AVRO
+        help_text: |
+          Database dump contains AVRO files.
+      default: mysql
+    - arg_name: destination-folder
+      api_field: exportMetadataRequest.destinationGcsFolder
+      required: true
+      processor: googlecloudsdk.command_lib.metastore.validators:ValidateGcsUri:arg_name=--destination-folder
+      help_text: |
+        A Cloud Storage URI of a folder that metadata is exported to, in the format
+        `gs://<bucket_name>/<path_inside_bukcet>`. A sub-folder containing
+        exported files will be created below it.
+
+  async:
+    collection: metastore.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/get_iam_policy.yaml

@@ -0,0 +1,34 @@
+release_tracks: [ALPHA, BETA, GA]
+help_text:
+  brief: Get the IAM policy for the service.
+  description: |
+    `{command}` displays the IAM policy associated with the service.
+    If formatted as JSON, the output can be edited and used as a
+    policy file for set-iam-policy. The output includes an "etag" field
+    identifying the version emitted and allowing detection of
+    concurrent policy updates. The "etag" field should be removed to be
+    used as set-iam-policy input; see `{parent_command} set-iam-policy`
+    for additional details.
+  examples: |
+    To print the IAM policy for a given service, run:
+
+      $ {command} my-service
+
+request:
+  collection: metastore.projects.locations.services
+  ALPHA:
+    api_version: v1alpha
+  BETA:
+    api_version: v1beta
+  GA:
+    api_version: v1
+
+iam:
+  enable_condition: false
+  policy_version: 0
+  get_iam_policy_version_path: options_requestedPolicyVersion
+
+arguments:
+  resource:
+    help_text: Service for which to display the IAM policy.
+    spec: !REF googlecloudsdk.command_lib.metastore.resources:service

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/import/__init__.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for metadata import of Dataproc Metastore services."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+class Import(base.Group):
+  """Import metadata into a Dataproc Metastore service."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/import/gcs.yaml

@@ -0,0 +1,72 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief:  |
+      Import metadata into a Dataproc Metastore service from Google Cloud Storage.
+    description: |
+      Import metadata into a Dataproc Metastore service from Google Cloud Storage.
+
+      If run asynchronously with `--async`, exits after printing
+      the operation name that can be used to poll the status of the
+      export via:
+
+        {top_command} metastore operations describe
+    examples: |
+      To import metadata with the name `my-import` and description `testing description`
+      into service `my-service` from a database dump with uri `gs://database-dump` and database
+      type `mysql`, run:
+
+          $ {command} my-service --import-id=my-import --description='testing description' \
+              --dump-type=mysql --database-dump=gs://database-dump
+
+  request:
+    method: create
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: metastore.projects.locations.services.metadataImports
+
+  arguments:
+    resource:
+      help_text: |
+        Arguments and flags that specify the Dataproc Metastore service
+        you want to import.
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:parent_service
+      is_parent_resource: true
+
+    params:
+    - arg_name: import-id
+      api_field: metadataImportId
+      help_text: |
+        The ID of this metadata import.
+      required: true
+    - arg_name: description
+      api_field: metadataImport.description
+      help_text: |
+        The description of this metadata import.
+    - arg_name: dump-type
+      api_field: metadataImport.databaseDump.type
+      help_text: |
+        The type of the database dump;. If unspecified, defaults to `mysql`.
+      choices:
+      - arg_value: mysql
+        enum_value: MYSQL
+        help_text: |
+          Database dump is a MYSQL dump file.
+      - arg_value: avro
+        enum_value: AVRO
+        help_text: |
+          Database dump contains AVRO files.
+      default: mysql
+    - arg_name: database-dump
+      api_field: metadataImport.databaseDump.gcsUri
+      required: true
+      processor: googlecloudsdk.command_lib.metastore.validators:ValidateGcsUri:arg_name=--database-dump
+      help_text: |
+        A Cloud Storage object URI that specifies a database dump from which to import metadata.
+        It must begin with `gs://`.
+
+  async:
+    collection: metastore.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/imports/__init__.py

@@ -0,0 +1,31 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2020 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for metadata imports under Dataproc Metastore services."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.Deprecate(
+    is_removed=False,
+    warning=(
+        'This command has been deprecated. '
+        'Please use `gcloud metastore services import` command group instead.'))
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA)
+class Imports(base.Group):
+  """Manage metadata imports under Dataproc Metastore services."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/imports/create.yaml

@@ -0,0 +1,73 @@
+- release_tracks: [ALPHA, BETA]
+  deprecate:
+    is_removed: false
+    warning: |
+      This command has been deprecated.
+      Please use `gcloud metastore services import gcs` instead.
+  help_text:
+    brief: |
+      Import metadata into a service.
+    description: |
+      Import metadata with the given name and configurations in to a service.
+
+    examples: |
+      To import metadata with the name `my-import` and description `testing description`
+      into service `my-service` from a database dump with uri `gs://database-dump` and database
+      type `mysql`, run:
+
+          $ {command} my-import --service=my-service --description='testing description' \
+              --database-type=mysql --database-dump=gs://database-dump
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    collection: metastore.projects.locations.services.metadataImports
+
+  arguments:
+    resource:
+      help_text: |
+        Arguments and flags that specify the metadata import
+        you want to create.
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:import
+    params:
+    - arg_name: description
+      api_field: metadataImport.description
+      help_text: |
+        The description of this metadata import.
+    - arg_name: database-type
+      api_field: metadataImport.databaseDump.databaseType
+      help_text: |
+        The type of the database. If unspecified, defaults to `MYSQL`.
+      choices:
+      - arg_value: MYSQL
+        enum_value: MYSQL
+        help_text:  |
+          MySQL Database
+      default: MYSQL
+      action:
+        deprecated:
+          removed: false
+          warn: |
+            The --database-type option is deprecated; use --database-dump-type instead.
+    - arg_name: database-dump-type
+      api_field: metadataImport.databaseDump.type
+      help_text: |
+        The type of the database dump. If unspecified, defaults to `MYSQL`
+      choices:
+      - arg_value: MYSQL
+        enum_value: MYSQL
+        help_text:  |
+          Database dump is a MYSQL dump file.
+      default: MYSQL
+    - arg_name: database-dump
+      required: true
+      api_field: metadataImport.databaseDump.gcsUri
+      processor: googlecloudsdk.command_lib.metastore.validators:ValidateGcsUri:arg_name=--database-dump
+      help_text: |
+        A Cloud Storage object URI that specifies a database dump from which to import metadata.
+        It must begin with `gs://`.
+
+  async:
+    collection: metastore.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/imports/describe.yaml

@@ -0,0 +1,33 @@
+- release_tracks: [ALPHA, BETA]
+  deprecate:
+    is_removed: false
+    warning: |
+      This command has been deprecated.
+      Please use `gcloud metastore services import` command group instead.
+  help_text:
+    brief: |
+      Describe a metadata import.
+    description: |
+      Describe a metadata import.
+
+      Displays all details of a metadata import given a valid import ID.
+    examples: |
+      To describe a metadata import with the ID
+      `my-import` under service `my-service`, run:
+
+        $ {command} my-import --service=my-service
+
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    collection: metastore.projects.locations.services.metadataImports
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:import
+      help_text: |
+        Arguments and flags that specify the metadata import you want
+        to describe.

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/imports/list.yaml

@@ -0,0 +1,45 @@
+- release_tracks: [ALPHA, BETA]
+  deprecate:
+    is_removed: false
+    warning: |
+      This command has been deprecated.
+      Please use `gcloud metastore services import` command group instead.
+  help_text:
+    brief: |
+      List metadata imports under a Dataproc Metastore service.
+    description: |
+      Lists all metadata imports under the specified Dataproc Metastore service.
+    examples: |
+      To list all metadata imports under service
+      `my-service`, run:
+
+        $ {command} --service=my-service
+
+      To list all metadata imports under all services and
+      all locations, run:
+
+        $ {command} --service=- --location=-
+
+  arguments:
+    resource:
+      help_text: The service to list the metadata imports for.
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:service
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    collection: metastore.projects.locations.services.metadataImports
+
+  response:
+    id_field: name
+
+  output:
+    format: |
+      table(
+        name.basename():label=NAME,
+        state:label=STATE,
+        databaseDump.databaseType:label=DATABASE_TYPE,
+        createTime.date()
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/imports/update.yaml

@@ -0,0 +1,51 @@
+- release_tracks: [ALPHA, BETA]
+  deprecate:
+    is_removed: false
+    warning: |
+      This command has been deprecated.
+      Please use `gcloud metastore services import` command group instead.
+  help_text:
+    brief: |
+      Update a metadata import.
+    description: |
+      Update the parameters of a metadata import. Only the description
+      field of a metadata import is supported to be updated.
+
+      If run asynchronously with `--async`, exits after printing
+      one operation name that can be used to poll the status of the
+      update via:
+
+        {top_command} metastore operations describe
+    examples: |
+      To update a metadata import with the name `my-metadata-import` to
+      have description `New description`, run:
+
+          $ {command} my-metadata-import --description="New description"
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    collection: metastore.projects.locations.services.metadataImports
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.metastore.services.imports.util:UpdateDescription
+
+  arguments:
+    resource:
+      help_text: |
+        Arguments and flags that specify the metadata import
+        you want to create.
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:import
+    params:
+    - arg_name: description
+      api_field: metadataImport.description
+      processor: googlecloudsdk.command_lib.metastore.validators:ValidateStringField:arg_name=--description
+      help_text: |
+        The description of the metadata import.
+
+  async:
+    collection: metastore.projects.locations.operations
+  update:
+    # b/136698204
+    read_modify_update: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/list.yaml

@@ -0,0 +1,45 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: |
+      List Dataproc Metastore services.
+    description: |
+      Lists all Services under the specified project and location.
+    examples: |
+      To list all Dataproc Metastore services in location
+      `us-central1`, run:
+
+        $ {command} --location=us-central1
+
+      To list all Dataproc Metastore services in all locations,
+      run:
+
+        $ {command} --location=-
+
+  arguments:
+    resource:
+      help_text: The location of the services to list.
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:location
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: metastore.projects.locations.services
+
+  response:
+    id_field: name
+
+  output:
+    format: |
+      table(
+        name.basename():label=NAME,
+        name.segment(3):label=LOCATION,
+        state:label=STATE,
+        tier:label=TIER,
+        network.basename():label=NETWORK,
+        endpointUri:label=URI,
+        hiveMetastoreConfig.version:label=METASTORE_VERSION
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/migrations/__init__.py

@@ -0,0 +1,26 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2024 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for managed migration to a Dataproc Metastore service."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA)
+class Migrations(base.Group):
+  """Manage the migration to a Dataproc Metastore service."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/migrations/cancel.yaml

@@ -0,0 +1,28 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief:  |
+      Cancel the migration to Dataproc Metastore service.
+    description: |
+      Cancel the migration to Dataproc Metastore service.
+
+      If run asynchronously with `--async`, exits after printing
+      the operation name that can be used to poll the status of the
+      migration operation via:
+
+        {top_command} metastore operations describe
+  request:
+    method: cancelMigration
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    collection: metastore.projects.locations.services
+
+  arguments:
+    resource:
+      help_text: |
+        The Dataproc Metastore service to cancel the migration on.
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:service
+
+  async:
+    collection: metastore.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/migrations/complete.yaml

@@ -0,0 +1,28 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief:  |
+      Complete the migration to Dataproc Metastore service.
+    description: |
+      Complete the migration to Dataproc Metastore service.
+
+      If run asynchronously with `--async`, exits after printing
+      the operation name that can be used to poll the status of the
+      migration operation via:
+
+        {top_command} metastore operations describe
+  request:
+    method: completeMigration
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    collection: metastore.projects.locations.services
+
+  arguments:
+    resource:
+      help_text: |
+        The Dataproc Metastore service to complete the migration on.
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:service
+
+  async:
+    collection: metastore.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/migrations/delete.yaml

@@ -0,0 +1,32 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: |
+      Delete a migration.
+    description: |
+      Delete a migration.
+
+      If run asynchronously with `--async`, exits after printing
+      an operation name that can be used to poll the status of the
+      deletion via:
+
+        {top_command} metastore operations describe
+    examples: |
+      To delete a migration named `my-migration` for the service `my-service`, run:
+
+          $ {command} my-migration --service=my-service
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    collection: metastore.projects.locations.services.migrationExecutions
+    method: delete
+
+  arguments:
+    resource:
+      help_text: Migration to delete.
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:migration
+
+  async:
+    collection: metastore.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/migrations/describe.yaml

@@ -0,0 +1,27 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: |
+      Describe a migration.
+    description: |
+      Describe a migration.
+
+      Displays all details of a migration given a migration ID.
+    examples: |
+      To describe a migration with the ID
+      `my-migration` under service `my-service`, run:
+
+        $ {command} my-migration --service=my-service
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    collection: metastore.projects.locations.services.migrationExecutions
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:migration
+      help_text: |
+        Arguments and flags that specify the migration you want
+        to describe.

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/migrations/list.yaml

@@ -0,0 +1,37 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: |
+      List migrations for a Dataproc Metastore service.
+    description: |
+      Lists all migrations for the specified Dataproc Metastore service.
+    examples: |
+      To list all migrations for service
+      `my-service`, run:
+
+        $ {command} --service=my-service
+
+  arguments:
+    resource:
+      help_text: The service to list the migrations for.
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:service
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    collection: metastore.projects.locations.services.migrationExecutions
+
+  response:
+    id_field: name
+
+  output:
+    format: |
+      table(
+        name.basename():label=NAME,
+        state:label=STATE,
+        phase:label=PHASE,
+        createTime.date(),
+        endTime.date(),
+        state_message:label=MESSAGE
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/migrations/start.yaml

@@ -0,0 +1,161 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief:  |
+      Start the migration on a Dataproc Metastore service.
+    description: |
+      Start the migration on a Dataproc Metastore service.
+
+      If run asynchronously with `--async`, exits after printing
+      the operation name that can be used to poll the status of the
+      migration operation via:
+
+        {top_command} metastore operations describe
+  request:
+    method: startMigration
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    collection: metastore.projects.locations.services
+
+  arguments:
+    resource:
+      help_text: |
+        The Dataproc Metastore service to start the migration on.
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:service
+    params:
+    - group:
+        help_text: |
+          Configuration information required by Dataproc Metastore to start the migration.
+        mutex: true
+        required: true
+        params:
+        - group:
+            help_text: |
+              Configuration information specific to migrating from "Self-Managed Hive Metastore on
+              Google Cloud Platform with Cloud SQL as the backend database" to a Dataproc Metastore
+              service.
+            params:
+            - group:
+                help_text: |
+                  Configuration information required for Dataproc Metastore to establish customer
+                  database connection before the cutover phase of migration.
+                required: true
+                params:
+                - arg_name: instance-connection-name
+                  api_field: startMigrationRequest.migrationExecution.cloudSqlMigrationConfig.cloudSqlConnectionConfig.instanceConnectionName
+                  processor: googlecloudsdk.command_lib.metastore.validators:ValidateCloudSqlInstanceConnectionName
+                  help_text: |
+                    The Cloud SQL database connection name, in the format,
+                    "project_id:region:instance_name"
+                  required: true
+                - arg_name: ip-address
+                  api_field: startMigrationRequest.migrationExecution.cloudSqlMigrationConfig.cloudSqlConnectionConfig.ipAddress
+                  processor: googlecloudsdk.command_lib.metastore.validators:ValidateCloudSqlIpAddress
+                  help_text: |
+                    The private IP address of the Cloud SQL instance.
+                  required: true
+                - arg_name: port
+                  api_field: startMigrationRequest.migrationExecution.cloudSqlMigrationConfig.cloudSqlConnectionConfig.port
+                  processor: googlecloudsdk.command_lib.metastore.validators:ValidatePort
+                  help_text: |
+                    The network port of the database.
+                  required: true
+                - arg_name: hive-database-name
+                  api_field: startMigrationRequest.migrationExecution.cloudSqlMigrationConfig.cloudSqlConnectionConfig.hiveDatabaseName
+                  processor: googlecloudsdk.command_lib.metastore.validators:ValidateHiveDatabaseName
+                  help_text: |
+                    The name of the hive metastore database.
+                  required: true
+                - arg_name: connection-username
+                  api_field: startMigrationRequest.migrationExecution.cloudSqlMigrationConfig.cloudSqlConnectionConfig.username
+                  help_text: |
+                    The username that Dataproc Metastore service should use to connect to the database.
+                  required: true
+                - arg_name: connection-password
+                  api_field: startMigrationRequest.migrationExecution.cloudSqlMigrationConfig.cloudSqlConnectionConfig.password
+                  help_text: |
+                    The password for the user that Dataproc Metastore service should use to connect to
+                    the database.
+                  required: true
+                - arg_name: proxy-subnet
+                  api_field: startMigrationRequest.migrationExecution.cloudSqlMigrationConfig.cloudSqlConnectionConfig.proxySubnet
+                  processor: googlecloudsdk.command_lib.metastore.validators:ValidateSubnetworkResourceName:arg_name=--proxy-subnet
+                  help_text: |
+                    The relative resource name of the subnetwork to deploy the SOCKS5 proxy service
+                    in. The subnetwork should reside in a network through which the Cloud SQL instance
+                    is accessible. The resource name should be in the format,
+                    "projects/{project_id}/regions/{region_id}/subnetworks/{subnetwork_id}"
+                  required: true
+                - arg_name: nat-subnet
+                  api_field: startMigrationRequest.migrationExecution.cloudSqlMigrationConfig.cloudSqlConnectionConfig.natSubnet
+                  processor: googlecloudsdk.command_lib.metastore.validators:ValidateSubnetworkResourceName:arg_name=--nat-subnet
+                  help_text: |
+                    The relative resource name of the subnetwork to be used for Private Service
+                    Connect. Note that this cannot be a regular subnet and is used only for NAT.
+                    More context in https://cloud.google.com/vpc/docs/about-vpc-hosted-services#psc-subnets.
+                    This subnet is used to publish the SOCKS5 proxy service. The subnet size must be
+                    at least `/29` and it should reside in a network through which the Cloud SQL
+                    instance is accessible. The resource name should be in the format,
+                    "projects/{project_id}/regions/{region_id}/subnetworks/{subnetwork_id}"
+                  required: true
+            - group:
+                help_text: |
+                  Configuration information required to start the Change Data Capture (CDC) streams
+                  from customer's Cloud SQL database to backend database of Dataproc Metastore.
+                required: true
+                params:
+                - arg_name: vpc-network
+                  api_field: startMigrationRequest.migrationExecution.cloudSqlMigrationConfig.cdcConfig.vpcNetwork
+                  processor: googlecloudsdk.command_lib.metastore.validators:ValidateNetworkResourceName:arg_name=--vpc-network
+                  help_text: |
+                    Fully qualified name of the Cloud SQL instance's VPC network or the shared VPC
+                    network that Datastream will peer to, in the following format:
+                    "projects/{project_id}/locations/global/networks/{network_id}".
+                    More context in https://cloud.google.com/datastream/docs/network-connectivity-options#privateconnectivity
+                  required: true
+                - arg_name: subnet-ip-range
+                  api_field: startMigrationRequest.migrationExecution.cloudSqlMigrationConfig.cdcConfig.subnetIpRange
+                  processor: googlecloudsdk.command_lib.metastore.validators:ValidateSubnetIpRange
+                  help_text: |
+                    A "/29" CIDR IP range for peering with datastream
+                  required: true
+                - arg_name: cdc-username
+                  api_field: startMigrationRequest.migrationExecution.cloudSqlMigrationConfig.cdcConfig.username
+                  help_text: |
+                    The username that the Datastream service should use for the MySQL connection.
+                  required: true
+                - arg_name: cdc-password
+                  api_field: startMigrationRequest.migrationExecution.cloudSqlMigrationConfig.cdcConfig.password
+                  help_text: |
+                    The password for the user that Datastream service should use for the MySQL
+                    connection.
+                  required: true
+                - arg_name: reverse-proxy-subnet
+                  api_field: startMigrationRequest.migrationExecution.cloudSqlMigrationConfig.cdcConfig.reverseProxySubnet
+                  processor: googlecloudsdk.command_lib.metastore.validators:ValidateSubnetworkResourceName:arg_name=--reverse-proxy-subnet
+                  help_text: |
+                    The URL of the subnetwork resource to create the VM instance hosting the reverse
+                    proxy in. More context in https://cloud.google.com/datastream/docs/private-connectivity#reverse-csql-proxy
+                    The subnetwork should reside in the network provided in the request that
+                    Datastream will peer to and should be in the same region as Datastream, in the
+                    following format.
+                    "projects/{project_id}/regions/{region_id}/subnetworks/{subnetwork_id}""
+                  required: true
+                - arg_name: bucket
+                  api_field: startMigrationRequest.migrationExecution.cloudSqlMigrationConfig.cdcConfig.bucket
+                  processor: googlecloudsdk.command_lib.metastore.validators:ValidateMigrationBucketName
+                  help_text: |
+                    The bucket to write the intermediate stream event data in. The bucket name must be
+                    without any prefix like "gs://".
+                    This field is optional. If not set, the Artifacts Cloud Storage bucket is used.
+                - arg_name: root-path
+                  api_field: startMigrationRequest.migrationExecution.cloudSqlMigrationConfig.cdcConfig.rootPath
+                  processor: googlecloudsdk.command_lib.metastore.validators:ValidateMigrationRootPath
+                  help_text: |
+                    The root path inside the Cloud Storage bucket. The stream event data will be
+                    written to this path. The default value is "/migration".
+                  default: /migration
+
+  async:
+    collection: metastore.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/move_table_to_database.yaml

@@ -0,0 +1,49 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: |
+      Move table to another database.
+    description: |
+      Move table to another database from a Dataproc Metastore service's underlying metadata store.
+
+      If run asynchronously with `--async`, exits after printing
+      one operation name that can be used to poll the status of the
+      creation via:
+
+        {top_command} metastore operations describe
+    examples: |
+      To move table to database with the table_name, source_db_name, and destination_db_name in location `us-central`, run:
+
+          $ {command} my-metastore-service --location=us-central1 --table_name=table_name_to_move
+            --source_db_name=database_name_to_move --destination_db_name=destination_database_name
+  request:
+    method: moveTableToDatabase
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection: metastore.projects.locations.services
+  arguments:
+    resource:
+      help_text: |
+        Arguments and flags that specify the table and the destination database you want to move to.
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:service
+    params:
+    - arg_name: table_name
+      api_field: moveTableToDatabaseRequest.tableName
+      help_text: |
+        The name of the table to be moved.
+      required: true
+    - arg_name: source_db_name
+      api_field: moveTableToDatabaseRequest.dbName
+      help_text: |
+        The name of the database where the table resides.
+      required: true
+    - arg_name: destination_db_name
+      api_field: moveTableToDatabaseRequest.destinationDbName
+      help_text: |
+        The name of the database where the table should be moved.
+      required: true
+  async:
+    collection: metastore.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/query_metadata.py

@@ -0,0 +1,181 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command to query metadata against Dataproc Metastore services database."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+import io
+import json
+import posixpath
+
+from apitools.base.py import exceptions as apitools_exceptions
+from googlecloudsdk.api_lib.metastore import operations_util
+from googlecloudsdk.api_lib.metastore import services_util as services_api_util
+from googlecloudsdk.api_lib.metastore import util as api_util
+from googlecloudsdk.api_lib.storage import storage_api
+from googlecloudsdk.api_lib.storage import storage_util
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.metastore import resource_args
+from googlecloudsdk.core import log
+from googlecloudsdk.core.resource import resource_printer
+import six
+
+DETAILED_HELP = {
+    'EXAMPLES':
+        """\
+          To query metadata against a Dataproc Metastore service with the name
+          `my-metastore-service` in location `us-central1`, and the sql query
+          "show tables;", run:
+
+          $ {command} my-metastore-service --location=us-central1
+          --query="show tables;"
+
+        """
+}
+
+
+def AddBaseArgs(parser):
+  """Parses provided arguments to add base arguments used for Alpha/Beta/GA.
+
+  Args:
+    parser: an argparse argument parser.
+  """
+  resource_args.AddServiceResourceArg(
+      parser, 'to query metadata', plural=False, required=True, positional=True)
+  parser.add_argument(
+      '--query',
+      required=True,
+      help="""\
+            Use Google Standard SQL query for Cloud Spanner and MySQL query
+            syntax for Cloud SQL. Cloud Spanner SQL is described at
+            https://cloud.google.com/spanner/docs/query-syntax)"
+        """,
+  )
+
+
+@base.UnicodeIsSupported
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+@base.DefaultUniverseOnly
+class Query(base.Command):
+  """Execute a SQL query against a Dataproc Metastore Service's metadata."""
+
+  detailed_help = DETAILED_HELP
+
+  @staticmethod
+  def Args(parser):
+    """See base class."""
+    AddBaseArgs(parser)
+    base.FORMAT_FLAG.AddToParser(parser)
+
+  def Run(self, args):
+    """Runs this command.
+
+    Args:
+      args: an argparse namespace. All the arguments that were provided to this
+        command invocation.
+
+    Returns:
+      Some value that we want to have printed later.
+    """
+    env_ref = args.CONCEPTS.service.Parse()
+    operation = None
+    try:
+      operation = services_api_util.QueryMetadata(
+          env_ref.RelativeName(), args.query, release_track=self.ReleaseTrack())
+      log.out.Print('with operation [{}]'.format(operation.name))
+    except apitools_exceptions.HttpError:
+      raise api_util.QueryMetadataError('Query did not succeed.')
+    operation_result = None
+    try:
+      operation_result = operations_util.PollAndReturnOperation(
+          operation,
+          'Waiting for [{}] to query'.format(env_ref.RelativeName()),
+          release_track=self.ReleaseTrack())
+    except api_util.OperationError as e:
+      log.UpdatedResource(
+          env_ref.RelativeName(),
+          kind='service',
+          is_async=False,
+          failed=six.text_type(e))
+    if (operation_result is None or
+        not operation_result.additionalProperties or
+        len(operation_result.additionalProperties) < 2):
+      return None
+    result_manifest_uri = None
+    for message in operation_result.additionalProperties:
+      if message.key == 'resultManifestUri':
+        result_manifest_uri = message.value.string_value
+    if result_manifest_uri is None:
+      return None
+    gcs_client = storage_api.StorageClient()
+    result_manifest_json = json.load(
+        io.TextIOWrapper(
+            gcs_client.ReadObject(
+                storage_util.ObjectReference.FromUrl(result_manifest_uri,
+                                                     True)),
+            encoding='utf-8'))
+
+    # Query succeed
+    log.out.Print(result_manifest_json['status']['message'],
+                  result_manifest_uri)
+    if not result_manifest_json['filenames']:
+      return None
+    if len(result_manifest_json['filenames']) > 1:
+      log.out.Print('The number of rows exceeds 1000 to display. ' +
+                    'Please find more results at the cloud storage location.')
+    query_result_file_name = result_manifest_json['filenames'][0]
+    return json.load(
+        io.TextIOWrapper(
+            gcs_client.ReadObject(
+                # GCS URIs follow POSIX path formatting.
+                storage_util.ObjectReference.FromUrl(
+                    posixpath.join(
+                        posixpath.dirname(result_manifest_uri),
+                        query_result_file_name,
+                    ),
+                    True,
+                )
+            ),
+            encoding='utf-8',
+        )
+    )
+
+  def Display(self, args, result):
+    """Displays the server response to a query.
+
+    This is called higher up the stack to over-write default display behavior.
+    What gets displayed depends on the mode in which the query was run.
+
+    Args:
+      args: The arguments originally passed to the command.
+      result: The output of the command before display.
+    """
+    if not result or 'metadata' not in result or 'columns' not in result[
+        'metadata'] or 'rows' not in result:
+      return
+    fields = [
+        field['name'] or '(Unspecified)'
+        for field in result['metadata']['columns']
+    ]
+    # Create the format string we pass to the table layout.
+    table_format = ','.join('row.slice({0}).join():label="{1}"'.format(i, f)
+                            for i, f in enumerate(fields))
+    rows = [{'row': row} for row in result['rows']]
+    # Can't use the PrintText method because we want special formatting.
+    resource_printer.Print(rows, 'table({0})'.format(table_format), out=log.out)

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/remove_iam_policy_binding.yaml

@@ -0,0 +1,32 @@
+release_tracks: [ALPHA, BETA, GA]
+help_text:
+  brief: Remove an IAM policy binding from a service.
+  description: |
+    Remove an IAM policy binding from a service.
+
+  examples: |
+    To remove an IAM policy binding for the role of 'roles/metastore.admin' for the user
+    'test-user@gmail.com', run:
+
+      $ {command} my-service --member='user:test-user@gmail.com' --role='roles/metastore.admin'
+
+    See https://cloud.google.com/iam/docs/managing-policies for details of
+    policy role and member types.
+
+request:
+  collection: metastore.projects.locations.services
+  ALPHA:
+    api_version: v1alpha
+  BETA:
+    api_version: v1beta
+  GA:
+    api_version: v1
+
+iam:
+  enable_condition: false
+  policy_version: 0
+
+arguments:
+  resource:
+    help_text: Service for which to remove the IAM policy from.
+    spec: !REF googlecloudsdk.command_lib.metastore.resources:service

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/restore.yaml

@@ -0,0 +1,81 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: |
+      Restore a Dataproc Metastore service.
+    description: |
+      Restore a Dataproc Metastore service from the given backup or backup-location
+
+      If run asynchronously with `--async`, exits after printing
+      an operation name that can be used to poll the status of the
+      creation via:
+
+        {top_command} metastore operations describe
+    examples: |
+      To restore a Dataproc Metastore service with the name `my-service` from the backup
+      `my-backup` with a `FULL` restore type, run:
+
+          $ {command} my-service --backup=my-backup --restore-type=full
+
+      To restore a Dataproc Metastore service with the name `my-service` from the backup-location
+      `gs://gcs_bucket` with a `FULL` restore type, run:
+
+          $ {command} my-service --backup-location=gs://gcs_bucket --restore-type=full
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+      modify_request_hooks:
+      - googlecloudsdk.command_lib.metastore.services.backups.util:UpdateBackupV1Alpha
+    BETA:
+      api_version: v1beta
+      modify_request_hooks:
+      - googlecloudsdk.command_lib.metastore.services.backups.util:UpdateBackupV1Beta
+    GA:
+      api_version: v1
+      modify_request_hooks:
+      - googlecloudsdk.command_lib.metastore.services.backups.util:UpdateBackupV1
+    collection: metastore.projects.locations.services
+    method: restore
+
+  arguments:
+    resource:
+      help_text: |
+        Arguments and flags that specify the Dataproc Metastore service
+        you want to restore.
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:service
+    params:
+    - group:
+        help_text: |
+          The backup resource or the location of the backup artifacts to store from.
+        required: true
+        mutex: true
+        params:
+        - arg_name: backup
+          api_field: restoreServiceRequest.backup
+          help_text:  |
+            The backup resource to restore from.
+            This can be the backup's ID, fully-qualified URL, or relative name in the form
+            `projects/{project_id}/locations/{location_id}/services/{service_id}/backups/{backup_id}`.
+        - arg_name: backup-location
+          api_field: restoreServiceRequest.backupLocation
+          help_text:  |
+            The location of the backup artifacts to restore from.
+            This should be a Cloud Storage URI, contains backup avro files under "avro/",
+            backup_metastore.json and service.json, in the form `gs://<path_to_backup>`.
+    - arg_name: restore-type
+      api_field: restoreServiceRequest.restoreType
+      help_text:  |
+        The type of restore to perform.
+      default: metadata-only
+      choices:
+      - arg_value: full
+        enum_value: FULL
+        help_text:  |
+          The service's metadata and configuration are restored.
+      - arg_value: metadata-only
+        enum_value: METADATA_ONLY
+        help_text:  |
+          Only the service's metadata is restored.
+
+  async:
+    collection: metastore.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/set_iam_policy.yaml

@@ -0,0 +1,33 @@
+release_tracks: [ALPHA, BETA, GA]
+help_text:
+  brief: Set the IAM policy for the service.
+  description: |
+    Sets the IAM policy for the given service as defined in a JSON or YAML file.
+
+    See https://cloud.google.com/iam/docs/managing-policies for details of
+    the policy file format and contents.
+
+  examples: |
+    The following command will read an IAM policy defined in a JSON file
+    'policy.json' and set it for the service 'my-service':
+
+    $ {command} my-service policy.json
+
+request:
+  collection: metastore.projects.locations.services
+  ALPHA:
+    api_version: v1alpha
+  BETA:
+    api_version: v1beta
+  GA:
+    api_version: v1
+
+iam:
+  enable_condition: false
+  policy_version: 0
+  get_iam_policy_version_path: options.requestedPolicyVersion
+
+arguments:
+  resource:
+    help_text: Service for which to display the IAM policy.
+    spec: !REF googlecloudsdk.command_lib.metastore.resources:service

gcloud auth application-default login/google-cloud-sdk/lib/surface/metastore/services/update.yaml

@@ -0,0 +1,415 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: |
+      Update a Dataproc Metastore service.
+    description: |
+      Update the metadata and/or configuration parameters of a Dataproc Metastore service.
+
+      If run asynchronously with `--async`, exits after printing
+      one operation name that can be used to poll the status of the
+      update via:
+
+        {top_command} metastore operations describe
+    examples: |
+      To update a Dataproc Metastore service with the name `my-metastore-service` to
+      have the port number 8080, and add the two labels, `env` and `foo`, run:
+
+          $ {command} my-metastore-service --port=8080 --update-labels=env=test,foo=bar
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+      modify_request_hooks:
+      - googlecloudsdk.command_lib.metastore.services.util:UpdateScalingConfig
+      - googlecloudsdk.command_lib.metastore.services.util:SetServiceRequestUpdateHiveMetastoreConfigs
+      - googlecloudsdk.command_lib.metastore.services.util:GenerateUpdateAuxiliaryVersionsConfigs
+      - googlecloudsdk.command_lib.metastore.services.util:UpdateServiceMaskHook
+      - googlecloudsdk.command_lib.metastore.validators:ValidateServiceMutexConfig
+    BETA:
+      api_version: v1beta
+      modify_request_hooks:
+      - googlecloudsdk.command_lib.metastore.services.util:UpdateScalingConfig
+      - googlecloudsdk.command_lib.metastore.services.util:SetServiceRequestUpdateHiveMetastoreConfigs
+      - googlecloudsdk.command_lib.metastore.services.util:GenerateUpdateAuxiliaryVersionsConfigs
+      - googlecloudsdk.command_lib.metastore.services.util:UpdateServiceMaskHook
+      - googlecloudsdk.command_lib.metastore.validators:ValidateServiceMutexConfig
+    GA:
+      api_version: v1
+      modify_request_hooks:
+      - googlecloudsdk.command_lib.metastore.services.util:UpdateScalingConfig
+      - googlecloudsdk.command_lib.metastore.services.util:SetServiceRequestUpdateHiveMetastoreConfigs
+      - googlecloudsdk.command_lib.metastore.services.util:GenerateUpdateAuxiliaryVersionsConfigs
+      - googlecloudsdk.command_lib.metastore.services.util:UpdateServiceMaskHook
+      - googlecloudsdk.command_lib.metastore.validators:ValidateServiceMutexConfig
+    collection: metastore.projects.locations.services
+
+  arguments:
+    resource:
+      help_text: |
+        Arguments and flags that specify the Dataproc Metastore service
+        you want to update.
+      spec: !REF googlecloudsdk.command_lib.metastore.resources:service
+    params:
+    - arg_name: port
+      api_field: service.port
+      processor: googlecloudsdk.command_lib.metastore.validators:ValidatePort
+      help_text: |
+        The TCP port on which the Metastore service will listen.
+    - arg_name: data-catalog-sync
+      default: false
+      api_field: service.metadataIntegration.dataCatalogConfig.enabled
+      help_text: |
+        Boolean flag to determine whether or not Dataproc Metastore metadata sync to Data Catalog
+        is enabled, false if unspecified.
+        Mutually exclusive with flag `--encryption-kms-key`.
+        Cannot be updated if the service uses customer-managed encryption keys.
+    - arg_name: deletion-protection
+      type: bool
+      api_field: service.deletionProtection
+      help_text: |
+        Flag that enables delete protection on Dataproc Metastore instance to prevent
+        accidental deletions of the instance.
+        Use --deletion-protection to enable and --no-deletion-protection to disable.
+    - group:
+        help_text: |
+          The instance size of the Dataproc Metastore instance.
+        mutex: true
+        params:
+        - arg_name: tier
+          api_field: service.tier
+          help_text: |
+            The tier of the service.
+          choices:
+          - arg_value: enterprise
+            enum_value: ENTERPRISE
+            help_text:  |
+              The enterprise tier provides multi-zone high availability, and sufficient
+              scalability for enterprise-level Dataproc Metastore workloads.
+          - arg_value: developer
+            enum_value: DEVELOPER
+            help_text:  |
+              The developer tier provides limited scalability and no fault tolerance.
+              Good for low-cost proof-of-concept.
+        - arg_name: scaling-factor
+          api_field: service.scalingConfig.scalingFactor
+          help_text: |
+            The scaling factor of the service.
+            Can be one of [0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 1.0, 2.0, 3.0, 4.0, 5.0, 6.0].
+          processor: googlecloudsdk.command_lib.metastore.validators:ValidateScalingFactor
+        - arg_name: instance-size
+          api_field: service.scalingConfig.instanceSize
+          help_text: |
+            The instance size of the service.
+          choices:
+          - arg_value: extra-small
+            enum_value: EXTRA_SMALL
+            help_text:  |
+              Extra small instance size, maps to a scaling factor of 0.1.
+          - arg_value: small
+            enum_value: SMALL
+            help_text:  |
+              Small instance size, maps to a scaling factor of 0.5.
+          - arg_value: medium
+            enum_value: MEDIUM
+            help_text:  |
+              Medium instance size, maps to a scaling factor of 1.0.
+          - arg_value: large
+            enum_value: LARGE
+            help_text:  |
+              Large instance size, maps to a scaling factor of 3.0.
+          - arg_value: extra-large
+            enum_value: EXTRA_LARGE
+            help_text:  |
+              Extra large instance size, maps to a scaling factor of 6.0.
+        - group:
+            help_text: |
+              The autoscaling configuration of the Dataproc Metastore instance.
+            params:
+            - arg_name: min-scaling-factor
+              api_field: service.scalingConfig.autoscalingConfig.limitConfig.minScalingFactor
+              help_text: |
+                The minimum scaling factor allowed by the autoscaler.
+                Can be one of [0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 1.0, 2.0, 3.0, 4.0, 5.0, 6.0].
+                The default value is 0.1.
+              processor: googlecloudsdk.command_lib.metastore.validators:ValidateMinScalingFactor
+            - arg_name: max-scaling-factor
+              api_field: service.scalingConfig.autoscalingConfig.limitConfig.maxScalingFactor
+              help_text: |
+                The maximum scaling factor allowed by the autoscaler.
+                Can be one of [0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 1.0, 2.0, 3.0, 4.0, 5.0, 6.0].
+                The default value is 6.0.
+              processor: googlecloudsdk.command_lib.metastore.validators:ValidateMaxScalingFactor
+    - arg_name: autoscaling-enabled
+      api_field: service.scalingConfig.autoscalingConfig.autoscalingEnabled
+      help_text: |
+        A boolean flag to determine whether Dataproc Metastore autoscaling should be enabled,
+        false if unspecified.
+
+        The default minimum and maximum scaling factors are 0.1 and 6.0, respectively.
+
+        The minimum and maximum scaling factors can be specified using --min-scaling-factor and
+        --max-scaling-factor.
+    - group:
+        help_text: |
+          Configuration properties specific to running Hive metastore
+          software as the metastore service.
+        mutex: true
+        params:
+        - arg_name: update-hive-metastore-configs-from-file
+          type: "googlecloudsdk.calliope.arg_parsers:FileContents:"
+          help_text: |
+            Path to a XML file containing a mapping of Hive metastore configuration key-value
+            pairs to apply to the Hive metastore.
+
+            For example:
+
+              hive-site.xml
+                  <configuration>
+                    <property>
+                      <name>hive.metastore.warehouse.dir</name>
+                      <value>${test.warehouse.dir}</value>
+                      <description></description>
+                    </property>
+                  </configuration>
+        - group:
+            help_text: |
+              Modify the Hive metastore configuration properties by passing key-value pairs
+              in through the flags.
+            params:
+            - arg_name: update-hive-metastore-configs
+              metavar: KEY=VALUE
+              type: "googlecloudsdk.calliope.arg_parsers:ArgDict:"
+              help_text: |
+                Comma-separated list of Hive metastore configurations. Each configuration has
+                the form "NAME=VALUE".
+            - group:
+                mutex: true
+                params:
+                - arg_name: remove-hive-metastore-configs
+                  type: "googlecloudsdk.calliope.arg_parsers:ArgList:"
+                  help_text: |
+                    Comma-separated list of configuration keys to remove with the form
+                    "KEY1, KEY2". If a label does not exist it is silently ignored. If
+                    --update-hive-metastore-configs is also specified, then
+                    --remove-hive-metastore-configs is applied first.
+                - arg_name: clear-hive-metastore-configs
+                  action: store_true
+                  help_text: |
+                    clear existing Hive metastore configurations. If --update-hive-metastore-configs
+                    is also specified, then --clear-hive-metastore-configs is applied first.
+    - group:
+        help_text: |
+          Information used to configure the Hive metastore service as a service principal
+          in a Kerberos realm.
+        params:
+        - arg_name: kerberos-principal
+          api_field: service.hiveMetastoreConfig.kerberosConfig.principal
+          processor: googlecloudsdk.command_lib.metastore.validators:ValidateKerberosPrincipal
+          help_text: |
+            A Kerberos principal that exists in the KDC to authenticate as. A typical principal
+            is of the form "primary/instance@REALM", but there is no exact format.
+        - arg_name: krb5-config
+          api_field: service.hiveMetastoreConfig.kerberosConfig.krb5ConfigGcsUri
+          processor: googlecloudsdk.command_lib.metastore.validators:ValidateGcsUri:arg_name=--krb5-config
+          help_text: |
+            A Cloud Storage URI that specifies the path to a krb5.conf file. It is of the form
+            gs://{bucket_name}/path/krb5.conf, although the file does not need to be named
+            krb5.conf explicitly.
+        - arg_name: keytab
+          api_field: service.hiveMetastoreConfig.kerberosConfig.keytab.cloudSecret
+          processor: googlecloudsdk.command_lib.metastore.parsers:ParseSecretManagerSecretVersion
+          help_text: |
+            A Kerberos keytab file that can be used to authenticate a service principal
+            with a Kerberos Key Distribution Center. This is a Secret Manager secret version,
+            and can be fully-qualified URL, or relative name in the form
+            `projects/{project_id}/secrets/{secret_id}/versions/{version_id}`.
+    - group:
+        help_text: |
+          The one hour maintenance window that specifies when Dataproc
+          Metastore may perform system maintenance operation to the service, in
+          UTC time.
+        params:
+        - arg_name: maintenance-window-day
+          api_field: service.maintenanceWindow.dayOfWeek
+          required: true
+          choices:
+          - arg_value: mon
+            enum_value: MONDAY
+          - arg_value: tue
+            enum_value: TUESDAY
+          - arg_value: wed
+            enum_value: WEDNESDAY
+          - arg_value: thu
+            enum_value: THURSDAY
+          - arg_value: fri
+            enum_value: FRIDAY
+          - arg_value: sat
+            enum_value: SATURDAY
+          - arg_value: sun
+            enum_value: SUNDAY
+          help_text: |
+            The day of week when the window starts, e.g., `sun`.
+        - arg_name: maintenance-window-hour
+          api_field: service.maintenanceWindow.hourOfDay
+          required: true
+          processor: googlecloudsdk.command_lib.metastore.validators:ValidateHourOfDay
+          help_text: |
+            The hour of day (0-23) when the window starts.
+    - arg_name: endpoint-protocol
+      help_text: |
+        The protocol to use for the metastore service endpoint.
+      choices:
+      - arg_value: thrift
+        enum_value: THRIFT
+        help_text:  |
+          The legacy Apache `THRIFT` protocol.
+      - arg_value: grpc
+        enum_value: GRPC
+        help_text:  |
+          The modernized `GRPC` protocol.
+      api_field: service.hiveMetastoreConfig.endpointProtocol
+    - group:
+        help_text: |
+          Auxiliary versions configuration for the Dataproc Metastore service. When specified,
+          a secondary Hive metastore service is created along with the primary service.
+        mutex: true
+        params:
+        - arg_name: update-auxiliary-versions-from-file
+          api_field: service.hiveMetastoreConfig.auxiliaryVersions
+          type: "googlecloudsdk.calliope.arg_parsers:YAMLFileContents:"
+          processor: googlecloudsdk.command_lib.metastore.services.util:LoadAuxiliaryVersionsConfigsFromYamlFile
+          help_text: |
+            Path to a YAML file containing the auxiliary versions configuration for
+            Dataproc Metastore instance. The file should contain a unique auxiliary service name and
+            auxiliary version that is lower than the primary service version. The primary version's
+            Hive metastore configs are applied to the auxiliary version. Additional Hive metastore
+            configs can be specified for the auxiliary version using "config_overrides". If a
+            specified config property has already been overridden in the primary Hive metastore
+            version's configs, the auxiliary version's override takes precedence.
+            The contents of the file should be structured as follows:
+
+            YAML:
+
+            ```
+              - name: aux-service1
+                version: x.y.z
+                config_overrides:
+                  key1: value1
+                  key2: value2
+                ...
+              - name: aux-service2
+                version: x.y.z
+                config_overrides:
+                  key1: value1
+                  key2: value2
+                ...
+              ...
+            ```
+        - group:
+            params:
+            - arg_name: add-auxiliary-versions
+              type: "arg_list"
+              help_text: |
+                Comma-separated list of auxiliary Hive metastore versions to deploy.
+                Auxiliary Hive metastore versions must be less than the primary Hive metastore
+                service's version.
+            - arg_name: clear-auxiliary-versions
+              action: store_true
+              help_text: |
+                Clears the existing auxiliary services attached to the primary Hive metastore
+                services. If --add-auxiliary-versions is also specified, --clear-auxiliary-versions
+                is applied first.
+    - group:
+        mutex: true
+        help_text: |
+          Scheduled backup configurations to enable a scheduled backup of the metastore service.
+        params:
+        - arg_name: scheduled-backup-configs-from-file
+          api_field: service.scheduledBackup
+          type: "googlecloudsdk.calliope.arg_parsers:FileContents:"
+          processor: googlecloudsdk.command_lib.metastore.services.util:LoadScheduledBackupConfigsFromJsonFile
+          help_text: |
+            Path to a JSON file containing a mapping of scheduled backup configurations key-value pairs to apply to the scheduled backup.
+
+            For example:
+
+              backup_configs.json
+                  {
+                    "enabled": true,
+                    "cron_schedule": "0 * * * *",
+                    "backup_location": "gs://example-bucket",
+                    "time_zone": "UTC"
+                  }
+        - group:
+            help_text: |
+              Scheduled backup configurations to enable a scheduled backup of the metastore service.
+            params:
+            - arg_name: enable-scheduled-backup
+              api_field: service.scheduledBackup.enabled
+              action: store_true
+              help_text: |
+                Enable or disable scheduled backups for the Metastore service.
+            - arg_name: scheduled-backup-cron
+              api_field: service.scheduledBackup.cronSchedule
+              help_text: |
+                Specify the frequency of a scheduled backup of the metastore service.
+            - arg_name: scheduled-backup-location
+              api_field: service.scheduledBackup.backupLocation
+              help_text: |
+                Set the Cloud Storage URI to store the scheduled backups of the metastore service.
+    - group:
+        release_tracks: [ALPHA, BETA]
+        hidden: true
+        help_text: |
+          Configuration required for migrating to BigQuery Metastore service.
+        params:
+        - arg_name: bigquery-project-id
+          api_field: service.bigqueryMetastoreMigrationConfig.bigqueryProjectId
+          help_text: |
+            Project ID where the BigQuery resources (e.g. datasets, tables, etc.)
+            should be created.
+        - arg_name: bigquery-dataset-location
+          api_field: service.bigqueryMetastoreMigrationConfig.bigqueryDatasetLocation
+          help_text: |
+            The location where the BigQuery resources (e.g. datasets, tables, etc.)
+            should be created (e.g. us-central1, us, eu, etc.).
+        - arg_name: desired-migration-state
+          api_field: service.bigqueryMetastoreMigrationConfig.desiredMigrationState
+          help_text: |
+            The desired state of the migration. Note that this also reflects the
+            current state of the migration. If an attempt to update to a new desired
+            state fails, the migration will revert to the previous state.
+          choices:
+          - arg_value: migrate
+            enum_value: MIGRATE
+            help_text:  |
+              By setting the desired migration state to `MIGRATE`, metadata updates in
+              Dataproc Metastore will be replicated to the BigQuery Metastore service,
+              ensuring that it remains consistently synchronized with Dataproc
+              Metastore. Note that this includes initial backfill of existing metadata.
+          - arg_value: cutover
+            enum_value: CUTOVER
+            help_text:  |
+              By setting the desired migration state to `CUTOVER`, all metadata
+              requests are routed to BigQuery Metastore service and Dataproc Metastore
+              only functions as a proxy. This state can be considered as the completion
+              of the migration.
+          - arg_value: cancel
+            enum_value: CANCEL
+            help_text:  |
+              By setting the desired migration state to `CANCEL`, the migration is
+              effectively cancelled. If the previous migration state was `MIGRATE`,
+              then replication to BigQuery Metastore will be cancelled. If the previous
+              state was `CUTOVER`, then metadata requests will now be served from
+              Dataproc Metastore instead of BigQuery Metastore. Note that existing
+              metadata changes replicated to BigQuery Metastore service are not rolled
+              back.
+    labels:
+      api_field: service.labels
+
+  async:
+    collection: metastore.projects.locations.operations
+  update:
+    # b/136698204
+    read_modify_update: true
+    disable_auto_field_mask: true