feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/__init__.py

@@ -0,0 +1,29 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2020 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for Network Connectivity Center spokes."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+class Spokes(base.Group):
+  """Manage Network Connectivity Center spokes."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/activate.py

@@ -0,0 +1,96 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Command for activating spokes."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_api
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_util
+from googlecloudsdk.api_lib.util import waiter
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.network_connectivity import flags
+from googlecloudsdk.core import log
+from googlecloudsdk.core import resources
+
+
+@base.Hidden
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.GA)
+class Activate(base.Command):
+  """Activate a spoke.
+
+  Activate a previously deactivated spoke. By activating a spoke,
+  you permit connectivity between it and any other spokes that are
+  attached to the same hub.
+  """
+
+  @staticmethod
+  def Args(parser):
+    flags.AddSpokeResourceArg(parser, 'to activate')
+    flags.AddRegionGroup(parser, hide_global_arg=True)
+    flags.AddAsyncFlag(parser)
+
+  def Run(self, args):
+    client = networkconnectivity_api.SpokesClient(
+        release_track=self.ReleaseTrack())
+    spoke_ref = args.CONCEPTS.spoke.Parse()
+    op_ref = client.Activate(spoke_ref)
+
+    log.status.Print('Activate request issued for: [{}]'.format(
+        spoke_ref.Name()))
+
+    op_resource = resources.REGISTRY.ParseRelativeName(
+        op_ref.name,
+        collection='networkconnectivity.projects.locations.operations',
+        api_version=networkconnectivity_util.VERSION_MAP[self.ReleaseTrack()])
+    poller = waiter.CloudOperationPoller(client.spoke_service,
+                                         client.operation_service)
+
+    if op_ref.done:
+      return poller.GetResult(op_resource)
+
+    if args.async_:
+      log.status.Print('Check operation [{}] for status.'.format(op_ref.name))
+      return op_ref
+
+    op_resource = resources.REGISTRY.ParseRelativeName(
+        op_ref.name,
+        collection='networkconnectivity.projects.locations.operations',
+        api_version=networkconnectivity_util.VERSION_MAP[self.ReleaseTrack()])
+    poller = waiter.CloudOperationPoller(client.spoke_service,
+                                         client.operation_service)
+    res = waiter.WaitFor(
+        poller, op_resource,
+        'Waiting for operation [{}] to complete'.format(op_ref.name))
+    return res
+
+
+Activate.detailed_help = {
+    'EXAMPLES':
+        """ \
+  To activate a spoke named ``myspoke'' in the ``us-central1'' region, run:
+
+    $ {command} myspoke --region=us-central1
+  """,
+    'API REFERENCE':
+        """ \
+  This command uses the networkconnectivity/v1 API. The full documentation
+  for this API can be found at:
+  https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest
+  """,
+}

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/create.yaml

@@ -0,0 +1,70 @@
+- release_tracks: [ALPHA]
+
+  help_text:
+    brief: Create a new spoke.
+    description: Create a new spoke with the given name.
+    examples: |
+      Create a spoke with name ``my-spoke'' attach to hub ``https://www.googleapis.com/networkconnectivity/v1/projects/my-project/locations/global/hubs/my-hub'' in region ``us-central1''.
+
+        $ {command} my-spoke --hub="https://www.googleapis.com/networkconnectivity/v1/projects/my-project/locations/global/hubs/my-hub" --region=us-central1
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:spoke
+      help_text: Name of the spoke to be created.
+    params:
+    - arg_name: hub
+      required: true
+      api_field: spoke.hub
+      help_text: Hub that spoke will attach to.
+    - arg_name: description
+      api_field: spoke.description
+      help_text: Description of the spoke to be created.
+    - arg_name: labels
+      api_field: spoke.labels.additionalProperties
+      metavar: KEY=VALUE
+      help_text: |
+        List of label KEY=VALUE pairs to add.
+      type:
+        arg_dict:
+          flatten: true
+          spec:
+          - api_field: key
+          - api_field: value
+    - group:
+        mutex: true
+        required: true
+        params:
+        - arg_name: vpn-tunnel
+          api_field: spoke.linkedVpnTunnels
+          type: arg_list
+          help_text: VPN tunnel that this spoke links to.
+        - arg_name: interconnect-attachment
+          api_field: spoke.linkedInterconnectAttachments
+          type: arg_list
+          help_text: Interconnect attachment that this spoke links to.
+        - arg_name: router-appliance
+          api_field: spoke.linkedRouterApplianceInstances
+          type:
+            arg_dict:
+              flatten: false
+              spec:
+              - api_field: virtualMachine
+                arg_name: instance
+                type: str
+              - api_field: ipAddress
+                arg_name: ip
+                type: str
+          help_text: |
+            Router appliance instance(s) that this spoke links to.
+
+            For example, use `--router-appliance=instance=ins_1,ip=10.10.0.1` to add a single router-appliance instance,
+            or `--router-appliance=instance=ins_1,ip=10.10.0.1 --router-appliance=instance=ins_2,ip=10.10.0.1 ...`
+            to add multiple instances.
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request: &request
+    api_version: v1alpha1
+    method: create
+    collection: networkconnectivity.projects.locations.spokes

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/deactivate.py

@@ -0,0 +1,92 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Command for deactivating spokes."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_api
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_util
+from googlecloudsdk.api_lib.util import waiter
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.network_connectivity import flags
+from googlecloudsdk.core import log
+from googlecloudsdk.core import resources
+
+
+@base.Hidden
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.GA)
+class Deactivate(base.Command):
+  """Deactivate a spoke.
+
+  Deactivate the specified spoke. When you deactivate a spoke, it
+  can't connect to other spokes that are attached to the same hub.
+
+  Network Connectivity Center retains details about deactivated
+  spokes so that they can be reactivated later.
+  """
+
+  @staticmethod
+  def Args(parser):
+    flags.AddSpokeResourceArg(parser, 'to deactivate')
+    flags.AddRegionGroup(parser, hide_global_arg=True)
+    flags.AddAsyncFlag(parser)
+
+  def Run(self, args):
+    client = networkconnectivity_api.SpokesClient(
+        release_track=self.ReleaseTrack())
+    spoke_ref = args.CONCEPTS.spoke.Parse()
+    op_ref = client.Deactivate(spoke_ref)
+
+    log.status.Print('Deactivate request issued for: [{}]'.format(
+        spoke_ref.Name()))
+
+    op_resource = resources.REGISTRY.ParseRelativeName(
+        op_ref.name,
+        collection='networkconnectivity.projects.locations.operations',
+        api_version=networkconnectivity_util.VERSION_MAP[self.ReleaseTrack()])
+    poller = waiter.CloudOperationPoller(client.spoke_service,
+                                         client.operation_service)
+
+    if op_ref.done:
+      return poller.GetResult(op_resource)
+
+    if args.async_:
+      log.status.Print('Check operation [{}] for status.'.format(op_ref.name))
+      return op_ref
+
+    res = waiter.WaitFor(poller, op_resource,
+                         'Waiting for operation [{}] to complete'.format(
+                             op_ref.name))
+    return res
+
+
+Deactivate.detailed_help = {
+    'EXAMPLES':
+        """ \
+  To deactivate a spoke named ``myspoke'' in the ``us-central1'' region, run:
+
+    $ {command} myspoke --region=us-central1
+  """,
+    'API REFERENCE':
+        """ \
+  This command uses the networkconnectivity/v1 API. The full documentation
+  for this API can be found at:
+  https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest
+  """,
+}

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/delete.py

@@ -0,0 +1,94 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Command for deleting spokes."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_api
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_util
+from googlecloudsdk.api_lib.util import waiter
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.network_connectivity import flags
+from googlecloudsdk.core import log
+from googlecloudsdk.core import resources
+from googlecloudsdk.core.console import console_io
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.GA)
+class Delete(base.DeleteCommand):
+  """Delete a spoke.
+
+  Delete the specified spoke.
+  """
+
+  @staticmethod
+  def Args(parser):
+    flags.AddSpokeResourceArg(parser, 'to delete')
+    flags.AddRegionGroup(parser, hide_global_arg=False)
+    flags.AddAsyncFlag(parser)
+
+  def Run(self, args):
+    client = networkconnectivity_api.SpokesClient(
+        release_track=self.ReleaseTrack())
+    spoke_ref = args.CONCEPTS.spoke.Parse()
+
+    console_io.PromptContinue(
+        message=('You are about to delete spoke [{}]'.format(spoke_ref.Name())),
+        cancel_on_no=True)
+
+    op_ref = client.Delete(spoke_ref)
+
+    log.status.Print('Delete request issued for: [{}]'.format(spoke_ref.Name()))
+
+    if op_ref.done:
+      log.DeletedResource(spoke_ref.Name(), kind='spoke')
+      return op_ref
+
+    if args.async_:
+      log.status.Print('Check operation [{}] for status.'.format(op_ref.name))
+      return op_ref
+
+    api_version = networkconnectivity_util.VERSION_MAP[self.ReleaseTrack()]
+    op_resource = resources.REGISTRY.ParseRelativeName(
+        op_ref.name,
+        collection='networkconnectivity.projects.locations.operations',
+        api_version=api_version)
+    poller = waiter.CloudOperationPollerNoResources(
+        client.operation_service)
+    res = waiter.WaitFor(poller, op_resource,
+                         'Waiting for operation [{}] to complete'.format(
+                             op_ref.name))
+    log.DeletedResource(spoke_ref.Name(), kind='spoke')
+    return res
+
+
+Delete.detailed_help = {
+    'EXAMPLES':
+        """ \
+  To delete a spoke named ``myspoke'' in the ``us-central1'' region, run:
+
+    $ {command} myspoke --region=us-central1
+  """,
+    'API REFERENCE':
+        """ \
+  This command uses the networkconnectivity/v1 API. The full documentation
+  for this API can be found at:
+  https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest
+  """,
+}

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/delete.yaml

@@ -0,0 +1,23 @@
+- release_tracks: [ALPHA]
+
+  help_text:
+    brief: Delete a spoke.
+    description: Delete the specified spoke.
+    examples: |
+      To delete a spoke with name ``myspoke'' in region ``us-central1'', run:
+
+        $ {command} myspoke --region=us-central1
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:spoke
+      help_text: Name of the spoke to be deleted.
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request: &request
+    ALPHA:
+      api_version: v1alpha1
+    method: delete
+    collection: networkconnectivity.projects.locations.spokes

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/describe.py

@@ -0,0 +1,60 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Command for describing spokes."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_api
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.network_connectivity import flags
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.GA)
+class Describe(base.DescribeCommand):
+  """Describe a spoke.
+
+  Retrieve and display details about a spoke.
+  """
+
+  @staticmethod
+  def Args(parser):
+    flags.AddSpokeResourceArg(parser, 'to describe')
+    flags.AddRegionGroup(parser, hide_global_arg=False)
+
+  def Run(self, args):
+    client = networkconnectivity_api.SpokesClient(
+        release_track=self.ReleaseTrack())
+    spoke_ref = args.CONCEPTS.spoke.Parse()
+    return client.Get(spoke_ref)
+
+
+Describe.detailed_help = {
+    'EXAMPLES':
+        """ \
+  To display details about a spoke named ``myspoke'' in the ``us-central1'' region, run:
+
+    $ {command} myspoke --region=us-central1
+  """,
+    'API REFERENCE':
+        """ \
+  This command uses the networkconnectivity/v1 API. The full documentation
+  for this API can be found at:
+  https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest
+  """,
+}

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/describe.yaml

@@ -0,0 +1,19 @@
+- release_tracks: [ALPHA]
+
+  help_text:
+    brief: Describe a spoke.
+    description: Retrieve and display details about a spoke.
+    examples: |
+      To display details about the spoke named ``spoke-1'' in region ``us-central1'', run:
+
+        $ {command} spoke-1 --region=us-central1
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:spoke
+      help_text: Name of the spoke you want to describe.
+
+  request: &request
+    ALPHA:
+      api_version: v1alpha1
+    collection: networkconnectivity.projects.locations.spokes

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/gateways/__init__.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2024 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for gateway spokes."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+class GatewaySpokes(base.Group):
+  """Manage Gateway spokes."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/gateways/advertised_routes/__init__.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for gateway advertised routes."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+class GatewayAdvertisedRoutes(base.Group):
+  """Manage gateway advertised routes."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/gateways/advertised_routes/create.yaml

@@ -0,0 +1,57 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: Create a new gateway advertised route.
+    description: Create a new gateway advertised route with the given name.
+    examples: |
+      Create an advertised route with name ``my-route'' for gateway spoke ``my-gateway'' in region ``us-central1'':
+
+        $ {command} my-route --spoke=my-gateway --region=us-central1 --ip-range=10.0.1.0/24
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:gatewayAdvertisedRoute
+      help_text: Name of the gateway advertised route to be created.
+    params:
+    - arg_name: description
+      BETA:
+        api_field: googleCloudNetworkconnectivityV1betaGatewayAdvertisedRoute.description
+      help_text: Description of the advertised route to be created.
+    - arg_name: ip-range
+      BETA:
+        api_field: googleCloudNetworkconnectivityV1betaGatewayAdvertisedRoute.ipRange
+      required: true
+      help_text: Advertise this IP range.
+    - group:
+        mutex: true
+        required: true
+        params:
+        - arg_name: advertise-to-hub
+          type: bool
+          help_text: The gateway should advertise this route toward the hub.
+    - arg_name: priority
+      BETA:
+        api_field: googleCloudNetworkconnectivityV1betaGatewayAdvertisedRoute.priority
+      help_text: This route's priority. Must be between 0 and 65335.
+    - arg_name: labels
+      BETA:
+        api_field: googleCloudNetworkconnectivityV1betaGatewayAdvertisedRoute.labels.additionalProperties
+      metavar: KEY=VALUE
+      help_text: |
+        List of label KEY=VALUE pairs to add.
+      type:
+        arg_dict:
+          flatten: true
+          spec:
+          - api_field: key
+          - api_field: value
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request: &request
+    BETA:
+      api_version: v1beta
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.network_connectivity.util:SetGatewayAdvertisedRouteRecipient
+    method: create
+    collection: networkconnectivity.projects.locations.spokes.gatewayAdvertisedRoutes

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/gateways/advertised_routes/delete.yaml

@@ -0,0 +1,23 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: Delete a gateway advertised route.
+    description: Delete the specified advertised route for a gateway spoke.
+    examples: |
+      To delete an advertised route with name ``my-route'' for spoke ``my-spoke'' in region ``us-central1'', run:
+
+        $ {command} my-route --region=us-central1 --spoke=my-spoke
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:gatewayAdvertisedRoute
+      help_text: Name of the advertised route to be deleted.
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request: &request
+    BETA:
+      api_version: v1beta
+    method: delete
+    collection: networkconnectivity.projects.locations.spokes.gatewayAdvertisedRoutes

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/gateways/advertised_routes/describe.yaml

@@ -0,0 +1,20 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: Describe a gateway advertised route.
+    description: Retrieve and display details about a gateway advertised route.
+
+    examples: |
+      To display details about a gateway advertised route named ``my-route'', run:
+
+        $ {command} my-route --region=us-central1 --spoke=my-gateway
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:gatewayAdvertisedRoute
+      help_text: Name of the gateway advertised route to be described.
+
+  request: &request
+    BETA:
+      api_version: v1beta
+    collection: networkconnectivity.projects.locations.spokes.gatewayAdvertisedRoutes

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/gateways/advertised_routes/list.yaml

@@ -0,0 +1,43 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: List gateway advertised routes.
+    description: Retrieve and display a list of advertised routes for the specified gateway spoke.
+    examples: |
+      To list all advertised routes across all gateway spokes, run:
+
+        $ {command} --region=- --spoke=-
+
+      To list advertised routes for all gateway spokes in region ``us-central1'', run:
+
+        $ {command} --region=us-central1
+
+      To list all advertised routes for spoke `my-gateway`, run:
+
+        $ {command} --region=us-central1 --spoke=my-gateway
+
+  request: &request
+    BETA:
+      api_version: v1beta
+    collection: networkconnectivity.projects.locations.spokes.gatewayAdvertisedRoutes
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.network_connectivity.util:CheckRegionSpecifiedIfSpokeSpecified
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:spokeDefaultAll
+      help_text: A gateway spoke. Use this flag to filter the list of advertised routes to a specific spoke. Use ``-`` to specify all spokes.
+
+  output:
+    BETA:
+      format: |
+        table(
+            name.basename():sort=3,
+            name.segment(3):label=LOCATION:sort=1,
+            name.segment(5):label=SPOKE:sort=2,
+            ip_range,
+            recipient,
+            priority,
+            state,
+            description
+        )

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/gateways/create.py

@@ -0,0 +1,179 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2024 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Command for creating Gateway spokes."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_api
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_util
+from googlecloudsdk.api_lib.util import apis
+from googlecloudsdk.api_lib.util import waiter
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.network_connectivity import flags
+from googlecloudsdk.command_lib.util.args import labels_util
+from googlecloudsdk.core import log
+from googlecloudsdk.core import resources
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+class Create(base.Command):
+  """Create a new Gateway spoke.
+
+  Create a new Gateway spoke.
+  """
+
+  @staticmethod
+  def Args(parser):
+    messages = apis.GetMessagesModule('networkconnectivity', 'v1beta')
+
+    flags.AddSpokeResourceArg(
+        parser, 'to create', flags.ResourceLocationType.REGION_ONLY
+    )
+    flags.AddRegionFlag(
+        parser, supports_region_wildcard=False, hidden=False, required=True
+    )
+    flags.AddHubFlag(parser)
+    flags.AddGroupFlag(parser, required=True)
+    flags.AddDescriptionFlag(parser, 'Description of the spoke to create.')
+    flags.AddAsyncFlag(parser)
+    flags.AddLandingNetworkFlag(parser)
+    flags.AddCapacityFlag(
+        messages.GoogleCloudNetworkconnectivityV1betaGateway, parser
+    )
+    flags.AddIpRangeReservationsFlag(parser)
+    labels_util.AddCreateLabelsFlags(parser)
+
+  def Run(self, args):
+    client = networkconnectivity_api.SpokesClient(
+        release_track=self.ReleaseTrack()
+    )
+
+    spoke_ref = args.CONCEPTS.spoke.Parse()
+
+    if self.ReleaseTrack() == base.ReleaseTrack.BETA:
+      labels = labels_util.ParseCreateArgs(
+          args,
+          client.messages.GoogleCloudNetworkconnectivityV1betaSpoke.LabelsValue,
+      )
+
+      range_reservations = [
+          client.messages.GoogleCloudNetworkconnectivityV1betaIpRangeReservation(
+              ipRange=ip_range
+          )
+          for ip_range in args.ip_range_reservations
+      ]
+
+      if args.landing_network:
+        landing_network = (
+            client.messages.GoogleCloudNetworkconnectivityV1betaLandingNetwork(
+                network=args.landing_network
+            )
+        )
+      else:
+        landing_network = None
+
+      spoke = client.messages.GoogleCloudNetworkconnectivityV1betaSpoke(
+          hub=args.hub,
+          group=args.group,
+          gateway=client.messages.GoogleCloudNetworkconnectivityV1betaGateway(
+              capacity=flags.GetCapacityArg(
+                  client.messages.GoogleCloudNetworkconnectivityV1betaGateway
+              ).GetEnumForChoice(args.capacity),
+              landingNetwork=landing_network,
+              ipRangeReservations=range_reservations,
+          ),
+          description=args.description,
+          labels=labels,
+      )
+      op_ref = client.CreateSpokeBeta(spoke_ref, spoke)
+    else:
+      labels = labels_util.ParseCreateArgs(
+          args, client.messages.Spoke.LabelsValue
+      )
+
+      range_reservations = [
+          client.messages.IpRangeReservation(ipRange=ip_range)
+          for ip_range in args.ip_range_reservations
+      ]
+
+      if args.landing_network:
+        landing_network = client.messages.LandingNetwork(
+            network=args.landing_network
+        )
+      else:
+        landing_network = None
+
+      spoke = client.messages.Spoke(
+          hub=args.hub,
+          group=args.group,
+          gateway=client.messages.Gateway(
+              capacity=flags.GetCapacityArg(
+                  client.messages.Gateway
+              ).GetEnumForChoice(args.capacity),
+              landingNetwork=landing_network,
+              ipRangeReservations=range_reservations,
+          ),
+          description=args.description,
+          labels=labels,
+      )
+      op_ref = client.CreateSpoke(spoke_ref, spoke)
+
+    log.status.Print('Create request issued for: [{}]'.format(spoke_ref.Name()))
+
+    if op_ref.done:
+      log.CreatedResource(spoke_ref.Name(), kind='spoke')
+      return op_ref
+
+    if args.async_:
+      log.status.Print('Check operation [{}] for status.'.format(op_ref.name))
+      return op_ref
+
+    op_resource = resources.REGISTRY.ParseRelativeName(
+        op_ref.name,
+        collection='networkconnectivity.projects.locations.operations',
+        api_version=networkconnectivity_util.VERSION_MAP[self.ReleaseTrack()],
+    )
+    poller = waiter.CloudOperationPoller(
+        client.spoke_service, client.operation_service
+    )
+    res = waiter.WaitFor(
+        poller,
+        op_resource,
+        'Waiting for operation [{}] to complete'.format(op_ref.name),
+    )
+    log.CreatedResource(spoke_ref.Name(), kind='spoke')
+    return res
+
+
+Create.detailed_help = {
+    'EXAMPLES': """ \
+  To create a Gateway spoke named ``myspoke'' in us-central1, with a capacity of 10 Gbps and IP range reservations of 10.1.1.0/24
+
+    $ {command} myspoke --hub=my-hub --region us-central1 --group gateways --capacity 10g --ip-range-reservations 10.1.1.0/24
+
+  To create a Gateway spoke named ``myspoke'' in us-central1, with a capacity of 10 Gbps, IP range reservations of 10.1.1.0/24 and 10.1.2.0/24, and a landing network of my-vpc, run:
+
+    $ {command} myspoke --hub=my-hub --region us-central1 --group gateways --capacity 10g --ip-range-reservations 10.1.1.0/24,10.1.2.0/24  --landing-network my-vpc
+  """,
+    'API REFERENCE': """ \
+  This command uses the networkconnectivity/v1 API. The full documentation
+  for this API can be found at:
+  https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest
+  """,
+}

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/gateways/update.yaml

@@ -0,0 +1,46 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: Update a Gateway spoke.
+    description: Update the details of a Gateway spoke.
+
+    examples: |
+      To update the description of a Gateway spoke named ``my-spoke'', run:
+
+        $ {command} my-spoke --region=us-central1 --description="new spoke description"
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:spoke
+      help_text: Name of the spoke to update.
+    params:
+    - arg_name: description
+      BETA:
+        api_field: googleCloudNetworkconnectivityV1betaSpoke.description
+      help_text: New description of the spoke.
+    - arg_name: capacity
+      BETA:
+        api_field: googleCloudNetworkconnectivityV1betaSpoke.gateway.capacity
+      choices:
+      - enum_value: CAPACITY_1_GBPS
+        arg_value: 1g
+      - enum_value: CAPACITY_10_GBPS
+        arg_value: 10g
+      - enum_value: CAPACITY_100_GBPS
+        arg_value: 100g
+      help_text: New gateway capacity of the spoke.
+    labels:
+      BETA:
+        api_field: googleCloudNetworkconnectivityV1betaSpoke.labels
+
+  update:
+    read_modify_update: true
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request:
+    BETA:
+      api_version: v1beta
+    collection: networkconnectivity.projects.locations.spokes
+    method: patch

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/linked_interconnect_attachments/__init__.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for VLAN attachment spokes."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.GA)
+class LinkedInterconnectAttachmentSpokes(base.Group):
+  """Manage VLAN attachment spokes."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/linked_interconnect_attachments/create.yaml

@@ -0,0 +1,147 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: Create a new VLAN attachment spoke.
+    description: Create a new [VLAN attachment spoke](https://cloud.google.com/network-connectivity/docs/network-connectivity-center/how-to/working-with-hubs-spokes#create-vlan-spoke).
+    examples: |
+      To create a spoke in region ``us-central1'' that uses data transfer and has
+      two VLAN attachments, run:
+
+        $ {command} my-spoke --hub="https://www.googleapis.com/networkconnectivity/v1beta/projects/my-project/locations/global/hubs/my-hub" --region=us-central1 --interconnect-attachments=https://www.googleapis.com/compute/v1/projects/my-project/regions/us-central1/interconnectAttachments/ic1,https://www.googleapis.com/compute/v1/projects/my-project/regions/us-central1/interconnectAttachments/ic2 --site-to-site-data-transfer
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:spoke
+      help_text: Name of the spoke to be created.
+    params:
+    - arg_name: hub
+      required: true
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.hub
+      help_text: Hub that the spoke will attach to. The hub must already exist.
+    - arg_name: description
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.description
+      help_text: Description of the spoke to create.
+    - arg_name: interconnect-attachments
+      required: true
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedInterconnectAttachments.uris
+      type: arg_list
+      help_text: VLAN attachments that the spoke provides connectivity to. The resources must already exist.
+    - arg_name: site-to-site-data-transfer
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedInterconnectAttachments.siteToSiteDataTransfer
+      help_text: |
+        Whether to enable site-to-site data transfer for this spoke. Data transfer is available only
+        in [supported locations](https://cloud.google.com/network-connectivity/docs/network-connectivity-center/concepts/locations).
+    - arg_name: include-import-ranges
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedInterconnectAttachments.includeImportRanges
+      type: arg_list
+      help_text: |
+        IP address range(s) allowed to be imported from hub subnets. Only ``ALL_IPV4_RANGES`` can be
+        added to the list. If it's empty, the spoke does not import any subnets from the hub.
+    - arg_name: exclude-import-ranges
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedInterconnectAttachments.excludeImportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Hub routes overlapped/encompassed by exclude import ranges are excluded during import from hub.
+    - arg_name: include-export-ranges
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedInterconnectAttachments.includeExportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Dynamic routes fully encompassed by include export ranges are included during export to hub.
+        If it's empty, the spoke exports all dynamic routes to the hub.
+    - arg_name: exclude-export-ranges
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedInterconnectAttachments.excludeExportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Dynamic routes overlapped/encompassed by exclude export ranges are excluded during export to hub.
+    - arg_name: group
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.group
+      help_text: |
+        The group that the spoke will be added to. The group must already exist. If unset, the spoke
+        will be added to the ``default`` group.
+    labels:
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.labels
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request:
+    api_version: v1beta
+    method: create
+    collection: networkconnectivity.projects.locations.spokes
+
+- release_tracks: [GA]
+
+  help_text:
+    brief: Create a new VLAN attachment spoke.
+    description: Create a new [VLAN attachment spoke](https://cloud.google.com/network-connectivity/docs/network-connectivity-center/how-to/working-with-hubs-spokes#create-vlan-spoke).
+    examples: |
+      To create a spoke in region ``us-central1'' that uses data transfer and has
+      two VLAN attachments, run:
+
+        $ {command} my-spoke --hub="https://www.googleapis.com/networkconnectivity/v1/projects/my-project/locations/global/hubs/my-hub" --region=us-central1 --interconnect-attachments=https://www.googleapis.com/compute/v1/projects/my-project/regions/us-central1/interconnectAttachments/ic1,https://www.googleapis.com/compute/v1/projects/my-project/regions/us-central1/interconnectAttachments/ic2 --site-to-site-data-transfer
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:spoke
+      help_text: Name of the spoke to be created.
+    params:
+    - arg_name: hub
+      required: true
+      api_field: spoke.hub
+      help_text: Hub that the spoke will attach to. The hub must already exist.
+    - arg_name: description
+      api_field: spoke.description
+      help_text: Description of the spoke to create.
+    - arg_name: interconnect-attachments
+      required: true
+      api_field: spoke.linkedInterconnectAttachments.uris
+      type: arg_list
+      help_text: VLAN attachments that the spoke provides connectivity to. The resources must already exist.
+    - arg_name: site-to-site-data-transfer
+      api_field: spoke.linkedInterconnectAttachments.siteToSiteDataTransfer
+      help_text: |
+        Whether to enable site-to-site data transfer for this spoke. Data transfer is available only
+        in [supported locations](https://cloud.google.com/network-connectivity/docs/network-connectivity-center/concepts/locations).
+    - arg_name: include-import-ranges
+      api_field: spoke.linkedInterconnectAttachments.includeImportRanges
+      type: arg_list
+      help_text: |
+        IP address range(s) allowed to be imported from hub subnets. Only ``ALL_IPV4_RANGES`` can be
+        added to the list. If it's empty, the spoke does not import any subnets from the hub.
+    - arg_name: exclude-import-ranges
+      api_field: spoke.linkedInterconnectAttachments.excludeImportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Hub routes overlapped/encompassed by exclude import ranges are excluded during import from hub.
+    - arg_name: include-export-ranges
+      api_field: spoke.linkedInterconnectAttachments.includeExportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Dynamic routes fully encompassed by include export ranges are included during export to hub.
+        If it's empty, the spoke exports all dynamic routes to the hub.
+    - arg_name: exclude-export-ranges
+      api_field: spoke.linkedInterconnectAttachments.excludeExportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Dynamic routes overlapped/encompassed by exclude export ranges are excluded during export to hub.
+    - arg_name: group
+      api_field: spoke.group
+      help_text: |
+        The group that the spoke will be added to. The group must already exist. If unset, the spoke
+        will be added to the ``default`` group.
+    labels:
+      api_field: spoke.labels
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request:
+    api_version: v1
+    method: create
+    collection: networkconnectivity.projects.locations.spokes

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/linked_interconnect_attachments/update.yaml

@@ -0,0 +1,115 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: Update a VLAN attachment spoke.
+    description: Update the details of a VLAN attachment spoke.
+
+    examples: |
+      To update the description of a VLAN attachment spoke named ``my-spoke'', run:
+
+        $ {command} my-spoke --region=us-central1 --description="new spoke description"
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:spoke
+      help_text: Name of the spoke to update.
+    params:
+    - arg_name: description
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.description
+      help_text: New description of the spoke.
+    - arg_name: include-import-ranges
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedInterconnectAttachments.includeImportRanges
+      type: arg_list
+      help_text: |
+        IP address range(s) allowed to be imported from hub subnets. Only ``ALL_IPV4_RANGES`` can be
+        added to the list. If it's empty, the spoke does not import any subnets from the hub.
+    - arg_name: exclude-import-ranges
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedInterconnectAttachments.excludeImportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Hub routes overlapped/encompassed by exclude import ranges are excluded during import from hub.
+    - arg_name: include-export-ranges
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedInterconnectAttachments.includeExportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Dynamic routes fully encompassed by include export ranges are included during export to hub.
+        If it's empty, the spoke exports all dynamic routes to the hub.
+    - arg_name: exclude-export-ranges
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedInterconnectAttachments.excludeExportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Dynamic routes overlapped/encompassed by exclude export ranges are excluded during export to hub.
+    labels:
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.labels
+
+  update:
+    read_modify_update: true
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request:
+    api_version: v1beta
+    collection: networkconnectivity.projects.locations.spokes
+    method: patch
+
+- release_tracks: [GA]
+
+  help_text:
+    brief: Update a VLAN attachment spoke.
+    description: Update the details of a VLAN attachment spoke.
+
+    examples: |
+      To update the description of a VLAN attachment spoke named ``my-spoke'', run:
+
+        $ {command} my-spoke --region=us-central1 --description="new spoke description"
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:spoke
+      help_text: Name of the spoke to update.
+    params:
+    - arg_name: description
+      api_field: spoke.description
+      help_text: New description of the spoke.
+    - arg_name: include-import-ranges
+      api_field: spoke.linkedInterconnectAttachments.includeImportRanges
+      type: arg_list
+      help_text: |
+        IP address range(s) allowed to be imported from hub subnets. Only ``ALL_IPV4_RANGES`` can be
+        added to the list. If it's empty, the spoke does not import any subnets from the hub.
+    - arg_name: exclude-import-ranges
+      api_field: spoke.linkedInterconnectAttachments.excludeImportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Hub routes overlapped/encompassed by exclude import ranges are excluded during import from hub.
+    - arg_name: include-export-ranges
+      api_field: spoke.linkedInterconnectAttachments.includeExportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Dynamic routes fully encompassed by include export ranges are included during export to hub.
+        If it's empty, the spoke exports all dynamic routes to the hub.
+    - arg_name: exclude-export-ranges
+      api_field: spoke.linkedInterconnectAttachments.excludeExportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Dynamic routes overlapped/encompassed by exclude export ranges are excluded during export to hub.
+    labels:
+      api_field: spoke.labels
+
+  update:
+    read_modify_update: true
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request:
+    api_version: v1
+    collection: networkconnectivity.projects.locations.spokes
+    method: patch

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/linked_producer_vpc_network/__init__.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2024 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for Producer VPC spokes."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class LinkedProducerVpcNetworkSpokes(base.Group):
+  """Manage Producer VPC spokes."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/linked_producer_vpc_network/create.py

@@ -0,0 +1,145 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2024 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Command for creating Producer VPC spokes."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_api
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_util
+from googlecloudsdk.api_lib.util import waiter
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.network_connectivity import flags
+from googlecloudsdk.command_lib.util.args import labels_util
+from googlecloudsdk.core import log
+from googlecloudsdk.core import properties
+from googlecloudsdk.core import resources
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class Create(base.Command):
+  """Create a new Producer VPC spoke."""
+
+  @staticmethod
+  def Args(parser):
+    flags.AddSpokeResourceArg(parser, 'to create',
+                              flags.ResourceLocationType.GLOBAL_ONLY)
+    flags.AddRegionGroup(parser, hide_global_arg=False, hide_region_arg=True)
+    flags.AddHubFlag(parser)
+    flags.AddGroupFlag(parser)
+    flags.AddNetworkFlag(parser)
+    flags.AddPeeringFlag(parser)
+    flags.AddDescriptionFlag(parser, 'Description of the spoke to create.')
+    flags.AddAsyncFlag(parser)
+    flags.AddExcludeExportRangesFlag(
+        parser, hide_exclude_export_ranges_flag=False
+    )
+    flags.AddIncludeExportRangesFlag(
+        parser, hide_include_export_ranges_flag=False
+    )
+    labels_util.AddCreateLabelsFlags(parser)
+
+  def Run(self, args):
+    client = networkconnectivity_api.SpokesClient(
+        release_track=self.ReleaseTrack()
+    )
+
+    spoke_ref = args.CONCEPTS.spoke.Parse()
+
+    if self.ReleaseTrack() == base.ReleaseTrack.BETA:
+      labels = labels_util.ParseCreateArgs(
+          args,
+          client.messages.GoogleCloudNetworkconnectivityV1betaSpoke.LabelsValue,
+      )
+
+      spoke = client.messages.GoogleCloudNetworkconnectivityV1betaSpoke(
+          hub=args.hub,
+          group=args.group,
+          linkedProducerVpcNetwork=client.messages.GoogleCloudNetworkconnectivityV1betaLinkedProducerVpcNetwork(
+              network=args.network,
+              peering=args.peering,
+              excludeExportRanges=args.exclude_export_ranges,
+              includeExportRanges=args.include_export_ranges,
+          ),
+          description=args.description,
+          labels=labels,
+      )
+      op_ref = client.CreateSpokeBeta(spoke_ref, spoke)
+    else:
+      labels = labels_util.ParseCreateArgs(
+          args, client.messages.Spoke.LabelsValue
+      )
+
+      spoke = client.messages.Spoke(
+          hub=args.hub,
+          group=args.group,
+          linkedProducerVpcNetwork=client.messages.LinkedProducerVpcNetwork(
+              network=args.network,
+              peering=args.peering,
+              excludeExportRanges=args.exclude_export_ranges,
+              includeExportRanges=args.include_export_ranges,
+          ),
+          description=args.description,
+          labels=labels,
+      )
+      op_ref = client.CreateSpoke(spoke_ref, spoke)
+
+    log.status.Print('Create request issued for: [{}]'.format(spoke_ref.Name()))
+
+    if op_ref.done:
+      log.CreatedResource(spoke_ref.Name(), kind='spoke')
+      return op_ref
+
+    if args.async_:
+      log.status.Print('Check operation [{}] for status.'.format(op_ref.name))
+      return op_ref
+
+    op_resource = resources.REGISTRY.ParseRelativeName(
+        op_ref.name,
+        collection='networkconnectivity.projects.locations.operations',
+        api_version=networkconnectivity_util.VERSION_MAP[self.ReleaseTrack()],
+    )
+    poller = waiter.CloudOperationPoller(
+        client.spoke_service, client.operation_service
+    )
+    res = waiter.WaitFor(
+        poller,
+        op_resource,
+        'Waiting for operation [{}] to complete'.format(op_ref.name),
+    )
+    log.CreatedResource(spoke_ref.Name(), kind='spoke')
+    return res
+
+UNIVERSE_DOMAIN = properties.VALUES.core.universe_domain.Get()
+DETAILED_HELP = {
+    'EXAMPLES': f""" \
+  To create a Producer VPC spoke named ``myspoke'', run:
+
+    $ {{command}} myspoke --hub=https://www.{UNIVERSE_DOMAIN}/networkconnectivity/v1/projects/my-project/locations/global/hubs/my-hub \
+      --global \
+      --network=https://www.{UNIVERSE_DOMAIN}/compute/v1/projects/my-project/global/networks/my-vpc \
+      --peering=my-peering-name
+  """,
+    'API REFERENCE': """ \
+  This command uses the networkconnectivity/v1 API. The full documentation
+  for this API can be found at:
+  https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest
+  """,
+}
+
+Create.detailed_help = DETAILED_HELP

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/linked_producer_vpc_network/update.py

@@ -0,0 +1,164 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2024 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Command for updating spokes."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_api
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_util
+from googlecloudsdk.api_lib.util import waiter
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.network_connectivity import flags
+from googlecloudsdk.command_lib.util.args import labels_util
+from googlecloudsdk.core import log
+from googlecloudsdk.core import resources
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class Update(base.Command):
+  """Update a Producer VPC spoke.
+
+  Update the details of a Producer VPC spoke.
+  """
+
+  @staticmethod
+  def Args(parser):
+    flags.AddSpokeResourceArg(parser, 'to update',
+                              flags.ResourceLocationType.GLOBAL_ONLY)
+    flags.AddRegionGroup(parser, hide_global_arg=False, hide_region_arg=True)
+    flags.AddDescriptionFlag(parser, 'New description of the spoke.')
+    flags.AddAsyncFlag(parser)
+    labels_util.AddUpdateLabelsFlags(parser)
+    flags.AddUpdateIncludeExportRangesFlag(
+        parser,
+        hide_include_export_ranges_flag=False,
+    )
+    flags.AddUpdateExcludeExportRangesFlag(
+        parser,
+        hide_exclude_export_ranges_flag=False,
+    )
+
+  def Run(self, args):
+    client = networkconnectivity_api.SpokesClient(
+        release_track=self.ReleaseTrack())
+
+    spoke_ref = args.CONCEPTS.spoke.Parse()
+    update_mask = []
+    description = args.description
+    if description is not None:
+      update_mask.append('description')
+    include_export_ranges = args.include_export_ranges
+    exclude_export_ranges = args.exclude_export_ranges
+    if include_export_ranges is not None:
+      update_mask.append('linked_producer_vpc_network.include_export_ranges')
+    if exclude_export_ranges is not None:
+      update_mask.append('linked_producer_vpc_network.exclude_export_ranges')
+
+    labels = None
+    labels_diff = labels_util.Diff.FromUpdateArgs(args)
+
+    if self.ReleaseTrack() == base.ReleaseTrack.BETA:
+      if labels_diff.MayHaveUpdates():
+        original_spoke = client.Get(spoke_ref)
+        labels_update = labels_diff.Apply(
+            client.messages.GoogleCloudNetworkconnectivityV1betaSpoke.LabelsValue,
+            original_spoke.labels,
+        )
+        if labels_update.needs_update:
+          labels = labels_update.labels
+          update_mask.append('labels')
+
+      spoke = client.messages.GoogleCloudNetworkconnectivityV1betaSpoke(
+          description=description, labels=labels
+      )
+      if include_export_ranges is not None or exclude_export_ranges is not None:
+        spoke.linkedProducerVpcNetwork = (
+            client.messages.GoogleCloudNetworkconnectivityV1betaLinkedProducerVpcNetwork()
+        )
+        if include_export_ranges is not None:
+          spoke.linkedProducerVpcNetwork.includeExportRanges = (
+              include_export_ranges
+          )
+        if exclude_export_ranges is not None:
+          spoke.linkedProducerVpcNetwork.excludeExportRanges = (
+              exclude_export_ranges
+          )
+      op_ref = client.UpdateSpokeBeta(spoke_ref, spoke, update_mask)
+    else:
+      if labels_diff.MayHaveUpdates():
+        original_spoke = client.Get(spoke_ref)
+        labels_update = labels_diff.Apply(client.messages.Spoke.LabelsValue,
+                                          original_spoke.labels)
+        if labels_update.needs_update:
+          labels = labels_update.labels
+          update_mask.append('labels')
+
+      # Construct a spoke message with only the updated fields
+      spoke = client.messages.Spoke(description=description, labels=labels)
+      if include_export_ranges is not None or exclude_export_ranges is not None:
+        spoke.linkedProducerVpcNetwork = (
+            client.messages.LinkedProducerVpcNetwork()
+        )
+        if include_export_ranges is not None:
+          spoke.linkedProducerVpcNetwork.includeExportRanges = (
+              include_export_ranges
+          )
+        if exclude_export_ranges is not None:
+          spoke.linkedProducerVpcNetwork.excludeExportRanges = (
+              exclude_export_ranges
+          )
+      op_ref = client.UpdateSpoke(spoke_ref, spoke, update_mask)
+
+    log.status.Print('Update request issued for: [{}]'.format(spoke_ref.Name()))
+
+    if op_ref.done:
+      log.UpdatedResource(spoke_ref.Name(), kind='spoke')
+      return op_ref
+
+    if args.async_:
+      log.status.Print('Check operation [{}] for status.'.format(op_ref.name))
+      return op_ref
+
+    op_resource = resources.REGISTRY.ParseRelativeName(
+        op_ref.name,
+        collection='networkconnectivity.projects.locations.operations',
+        api_version=networkconnectivity_util.VERSION_MAP[self.ReleaseTrack()])
+    poller = waiter.CloudOperationPoller(client.spoke_service,
+                                         client.operation_service)
+    res = waiter.WaitFor(
+        poller, op_resource,
+        'Waiting for operation [{}] to complete'.format(op_ref.name))
+    log.UpdatedResource(spoke_ref.Name(), kind='spoke')
+    return res
+
+
+Update.detailed_help = {
+    'EXAMPLES':
+        """ \
+  To update the description of a Producer VPC spoke named ``my-spoke'', run:
+
+    $ {command} myspoke --global --description="new spoke description"
+  """,
+    'API REFERENCE':
+        """ \
+  This command uses the networkconnectivity/v1 API. The full documentation
+  for this API can be found at:
+  https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest
+  """,
+}

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/linked_router_appliances/__init__.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for Router appliance spokes."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.GA)
+class LinkedRouterApplianceSpokes(base.Group):
+  """Manage Router appliance spokes."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/linked_router_appliances/create.yaml

@@ -0,0 +1,175 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: Create a new Router appliance spoke.
+    description: Create a new [Router appliance spoke](https://cloud.google.com/network-connectivity/docs/network-connectivity-center/how-to/working-with-hubs-spokes#create-ra-spoke).
+    examples: |
+      To create a spoke in region ``us-central1'' that uses data transfer and has
+      two router appliance instances, run:
+
+        $ {command} my-spoke --hub="https://www.googleapis.com/networkconnectivity/v1/projects/my-project/locations/global/hubs/my-hub" --region=us-central1 --router-appliance=instance=https://www.googleapis.com/compute/v1/projects/my-project/zones/us-central1-a/instances/vm1,ip=10.10.0.1 --router-appliance=instance=https://www.googleapis.com/compute/v1/projects/my-project/zones/us-central1-a/instances/vm2,ip=10.10.0.2 --site-to-site-data-transfer
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:spoke
+      help_text: Name of the spoke to be created.
+    params:
+    - arg_name: hub
+      required: true
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.hub
+      help_text: Hub that the spoke will attach to. The hub must already exist.
+    - arg_name: description
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.description
+      help_text: Description of the spoke to create.
+    - arg_name: router-appliance
+      required: true
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedRouterApplianceInstances.instances
+      type:
+        arg_dict:
+          flatten: false
+          spec:
+          - api_field: virtualMachine
+            arg_name: instance
+            type: str
+          - api_field: ipAddress
+            arg_name: ip
+            type: str
+      help_text: |
+        Router appliance instance(s) that the spoke provides connectivity to. The resources must already exist.
+
+        For example, use `--router-appliance=instance=ins_uri_1,ip=10.10.0.1` to add a single router appliance instance,
+        or `--router-appliance=instance=ins_uri_1,ip=10.10.0.1 --router-appliance=instance=ins_uri_2,ip=10.10.0.2 ...`
+        to add multiple instances.
+    - arg_name: site-to-site-data-transfer
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedRouterApplianceInstances.siteToSiteDataTransfer
+      help_text: |
+        Whether to enable site-to-site data transfer for this spoke. Data transfer is available only
+        in [supported locations](https://cloud.google.com/network-connectivity/docs/network-connectivity-center/concepts/locations).
+    - arg_name: include-import-ranges
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedRouterApplianceInstances.includeImportRanges
+      type: arg_list
+      help_text: |
+        IP address range(s) allowed to be imported from hub subnets. Only ``ALL_IPV4_RANGES`` can be
+        added to the list. If it's empty, the spoke does not import any subnets from the hub.
+    - arg_name: exclude-import-ranges
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedRouterApplianceInstances.excludeImportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Hub routes overlapped/encompassed by exclude import ranges are excluded during import from hub.
+    - arg_name: include-export-ranges
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedRouterApplianceInstances.includeExportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Dynamic routes fully encompassed by include export ranges are included during export to hub.
+        If it's empty, the spoke exports all dynamic routes to the hub.
+    - arg_name: exclude-export-ranges
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedRouterApplianceInstances.excludeExportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Dynamic routes overlapped/encompassed by exclude export ranges are excluded during export to hub.
+    - arg_name: group
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.group
+      help_text: |
+        The group that the spoke will be added to. The group must already exist. If unset, the spoke
+        will be added to the ``default`` group.
+    labels:
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.labels
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request:
+    api_version: v1beta
+    method: create
+    collection: networkconnectivity.projects.locations.spokes
+
+- release_tracks: [GA]
+
+  help_text:
+    brief: Create a new Router appliance spoke.
+    description: Create a new [Router appliance spoke](https://cloud.google.com/network-connectivity/docs/network-connectivity-center/how-to/working-with-hubs-spokes#create-ra-spoke).
+    examples: |
+      To create a spoke in region ``us-central1'' that uses data transfer and has
+      two router appliance instances, run:
+
+        $ {command} my-spoke --hub="https://www.googleapis.com/networkconnectivity/v1/projects/my-project/locations/global/hubs/my-hub" --region=us-central1 --router-appliance=instance=https://www.googleapis.com/compute/v1/projects/my-project/zones/us-central1-a/instances/vm1,ip=10.10.0.1 --router-appliance=instance=https://www.googleapis.com/compute/v1/projects/my-project/zones/us-central1-a/instances/vm2,ip=10.10.0.2 --site-to-site-data-transfer
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:spoke
+      help_text: Name of the spoke to be created.
+    params:
+    - arg_name: hub
+      required: true
+      api_field: spoke.hub
+      help_text: Hub that the spoke will attach to. The hub must already exist.
+    - arg_name: description
+      api_field: spoke.description
+      help_text: Description of the spoke to create.
+    - arg_name: router-appliance
+      required: true
+      api_field: spoke.linkedRouterApplianceInstances.instances
+      type:
+        arg_dict:
+          flatten: false
+          spec:
+          - api_field: virtualMachine
+            arg_name: instance
+            type: str
+          - api_field: ipAddress
+            arg_name: ip
+            type: str
+      help_text: |
+        Router appliance instance(s) that the spoke provides connectivity to. The resources must already exist.
+
+        For example, use `--router-appliance=instance=ins_uri_1,ip=10.10.0.1` to add a single router appliance instance,
+        or `--router-appliance=instance=ins_uri_1,ip=10.10.0.1 --router-appliance=instance=ins_uri_2,ip=10.10.0.2 ...`
+        to add multiple instances.
+    - arg_name: site-to-site-data-transfer
+      api_field: spoke.linkedRouterApplianceInstances.siteToSiteDataTransfer
+      help_text: |
+        Whether to enable site-to-site data transfer for this spoke. Data transfer is available only
+        in [supported locations](https://cloud.google.com/network-connectivity/docs/network-connectivity-center/concepts/locations).
+    - arg_name: include-import-ranges
+      api_field: spoke.linkedRouterApplianceInstances.includeImportRanges
+      type: arg_list
+      help_text: |
+        IP address range(s) allowed to be imported from hub subnets. Only ``ALL_IPV4_RANGES`` can be
+        added to the list. If it's empty, the spoke does not import any subnets from the hub.
+    - arg_name: exclude-import-ranges
+      api_field: spoke.linkedRouterApplianceInstances.excludeImportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Hub routes overlapped/encompassed by exclude import ranges are excluded during import from hub.
+    - arg_name: include-export-ranges
+      api_field: spoke.linkedRouterApplianceInstances.includeExportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Dynamic routes fully encompassed by include export ranges are included during export to hub.
+        If it's empty, the spoke exports all dynamic routes to the hub.
+    - arg_name: exclude-export-ranges
+      api_field: spoke.linkedRouterApplianceInstances.excludeExportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Dynamic routes overlapped/encompassed by exclude export ranges are excluded during export to hub.
+    - arg_name: group
+      api_field: spoke.group
+      help_text: |
+        The group that the spoke will be added to. The group must already exist. If unset, the spoke
+        will be added to the ``default`` group.
+    labels:
+      api_field: spoke.labels
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request:
+    api_version: v1
+    method: create
+    collection: networkconnectivity.projects.locations.spokes

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/linked_router_appliances/update.yaml

@@ -0,0 +1,159 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: Update a Router appliance spoke.
+    description: Update the details of a Router appliance spoke.
+
+    examples: |
+      To update the description of a Router appliance spoke named ``my-spoke'', run:
+
+        $ {command} my-spoke --region=us-central1 --description="new spoke description"
+
+      To replace the router appliance instances linked to a spoke with two new instances, run:
+
+        $ {command} my-spoke --region=us-central1 --router-appliance=instance=https://www.googleapis.com/compute/v1/projects/my-project/zones/us-central1-a/instances/vm1,ip=10.10.0.1 --router-appliance=instance=https://www.googleapis.com/compute/v1/projects/my-project/zones/us-central1-a/instances/vm2,ip=10.10.0.2
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:spoke
+      help_text: Name of the spoke to update.
+    params:
+    - arg_name: description
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.description
+      help_text: New description of the spoke.
+    - arg_name: router-appliance
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedRouterApplianceInstances.instances
+      type:
+        arg_dict:
+          flatten: false
+          spec:
+          - api_field: virtualMachine
+            arg_name: instance
+            type: str
+          - api_field: ipAddress
+            arg_name: ip
+            type: str
+      help_text: |
+        Router appliance instance(s) with which to replace the set of instances already
+        linked to this spoke. Pass this flag multiple times to replace with multiple instances.
+        For example, use `--router-appliance=instance=new_ins_uri,ip=10.10.0.1` for a single router appliance instance,
+        or `--router-appliance=instance=new_ins_uri_1,ip=10.10.0.1 --router-appliance=instance=new_ins_uri_2,ip=10.10.0.2 ...`
+        for multiple instances.
+    - arg_name: include-import-ranges
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedRouterApplianceInstances.includeImportRanges
+      type: arg_list
+      help_text: |
+        IP address range(s) allowed to be imported from hub subnets. Only ``ALL_IPV4_RANGES`` can be
+        added to the list. If it's empty, the spoke does not import any subnets from the hub.
+    - arg_name: exclude-import-ranges
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedRouterApplianceInstances.excludeImportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Hub routes overlapped/encompassed by exclude import ranges are excluded during import from hub.
+    - arg_name: include-export-ranges
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedRouterApplianceInstances.includeExportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Dynamic routes fully encompassed by include export ranges are included during export to hub.
+        If it's empty, the spoke exports all dynamic routes to the hub.
+    - arg_name: exclude-export-ranges
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedRouterApplianceInstances.excludeExportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Dynamic routes overlapped/encompassed by exclude export ranges are excluded during export to hub.
+    labels:
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.labels
+
+  update:
+    read_modify_update: true
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request:
+    api_version: v1beta
+    collection: networkconnectivity.projects.locations.spokes
+    method: patch
+
+- release_tracks: [GA]
+
+  help_text:
+    brief: Update a Router appliance spoke.
+    description: Update the details of a Router appliance spoke.
+
+    examples: |
+      To update the description of a Router appliance spoke named ``my-spoke'', run:
+
+        $ {command} my-spoke --region=us-central1 --description="new spoke description"
+
+      To replace the router appliance instances linked to a spoke with two new instances, run:
+
+        $ {command} my-spoke --region=us-central1 --router-appliance=instance=https://www.googleapis.com/compute/v1/projects/my-project/zones/us-central1-a/instances/vm1,ip=10.10.0.1 --router-appliance=instance=https://www.googleapis.com/compute/v1/projects/my-project/zones/us-central1-a/instances/vm2,ip=10.10.0.2
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:spoke
+      help_text: Name of the spoke to update.
+    params:
+    - arg_name: description
+      api_field: spoke.description
+      help_text: New description of the spoke.
+    - arg_name: router-appliance
+      api_field: spoke.linkedRouterApplianceInstances.instances
+      type:
+        arg_dict:
+          flatten: false
+          spec:
+          - api_field: virtualMachine
+            arg_name: instance
+            type: str
+          - api_field: ipAddress
+            arg_name: ip
+            type: str
+      help_text: |
+        Router appliance instance(s) with which to replace the set of instances already
+        linked to this spoke. Pass this flag multiple times to replace with multiple instances.
+        For example, use `--router-appliance=instance=new_ins_uri,ip=10.10.0.1` for a single router appliance instance,
+        or `--router-appliance=instance=new_ins_uri_1,ip=10.10.0.1 --router-appliance=instance=new_ins_uri_2,ip=10.10.0.2 ...`
+        for multiple instances.
+    - arg_name: include-import-ranges
+      api_field: spoke.linkedRouterApplianceInstances.includeImportRanges
+      type: arg_list
+      help_text: |
+        IP address range(s) allowed to be imported from hub subnets. Only ``ALL_IPV4_RANGES`` can be
+        added to the list. If it's empty, the spoke does not import any subnets from the hub.
+    - arg_name: exclude-import-ranges
+      api_field: spoke.linkedRouterApplianceInstances.excludeImportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Hub routes overlapped/encompassed by exclude import ranges are excluded during import from hub.
+    - arg_name: include-export-ranges
+      api_field: spoke.linkedRouterApplianceInstances.includeExportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Dynamic routes fully encompassed by include export ranges are included during export to hub.
+        If it's empty, the spoke exports all dynamic routes to the hub.
+    - arg_name: exclude-export-ranges
+      api_field: spoke.linkedRouterApplianceInstances.excludeExportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Dynamic routes overlapped/encompassed by exclude export ranges are excluded during export to hub.
+    labels:
+      api_field: spoke.labels
+
+  update:
+    read_modify_update: true
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request:
+    api_version: v1
+    collection: networkconnectivity.projects.locations.spokes
+    method: patch

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/linked_vpc_network/__init__.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for VPC spokes."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.GA)
+class LinkedVPCNetworkSpokes(base.Group):
+  """Manage VPC spokes."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/linked_vpc_network/create.py

@@ -0,0 +1,145 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Command for creating spokes."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_api
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_util
+from googlecloudsdk.api_lib.util import waiter
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.network_connectivity import flags
+from googlecloudsdk.command_lib.util.args import labels_util
+from googlecloudsdk.core import log
+from googlecloudsdk.core import properties
+from googlecloudsdk.core import resources
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.GA)
+class Create(base.Command):
+  """Create a new VPC spoke.
+
+  Create a new VPC spoke.
+  """
+
+  @staticmethod
+  def Args(parser):
+    flags.AddSpokeResourceArg(
+        parser, 'to create', flags.ResourceLocationType.GLOBAL_ONLY
+    )
+    flags.AddRegionGroup(parser, hide_global_arg=False, hide_region_arg=True)
+    flags.AddHubFlag(parser)
+    flags.AddGroupFlag(parser)
+    flags.AddVPCNetworkFlag(parser)
+    flags.AddDescriptionFlag(parser, 'Description of the spoke to create.')
+    flags.AddAsyncFlag(parser)
+    flags.AddExcludeExportRangesFlag(
+        parser, hide_exclude_export_ranges_flag=False
+    )
+    flags.AddIncludeExportRangesFlag(
+        parser, hide_include_export_ranges_flag=False
+    )
+    labels_util.AddCreateLabelsFlags(parser)
+
+  def Run(self, args):
+    client = networkconnectivity_api.SpokesClient(
+        release_track=self.ReleaseTrack()
+    )
+
+    spoke_ref = args.CONCEPTS.spoke.Parse()
+
+    if self.ReleaseTrack() == base.ReleaseTrack.BETA:
+      labels = labels_util.ParseCreateArgs(
+          args,
+          client.messages.GoogleCloudNetworkconnectivityV1betaSpoke.LabelsValue,
+      )
+
+      spoke = client.messages.GoogleCloudNetworkconnectivityV1betaSpoke(
+          hub=args.hub,
+          group=args.group,
+          linkedVpcNetwork=client.messages.GoogleCloudNetworkconnectivityV1betaLinkedVpcNetwork(
+              uri=args.vpc_network,
+              excludeExportRanges=args.exclude_export_ranges,
+              includeExportRanges=args.include_export_ranges,
+          ),
+          description=args.description,
+          labels=labels,
+      )
+      op_ref = client.CreateSpokeBeta(spoke_ref, spoke)
+    else:
+      labels = labels_util.ParseCreateArgs(
+          args, client.messages.Spoke.LabelsValue
+      )
+
+      spoke = client.messages.Spoke(
+          hub=args.hub,
+          group=args.group,
+          linkedVpcNetwork=client.messages.LinkedVpcNetwork(
+              uri=args.vpc_network,
+              excludeExportRanges=args.exclude_export_ranges,
+              includeExportRanges=args.include_export_ranges,
+          ),
+          description=args.description,
+          labels=labels,
+      )
+      op_ref = client.CreateSpoke(spoke_ref, spoke)
+
+    log.status.Print('Create request issued for: [{}]'.format(spoke_ref.Name()))
+
+    if op_ref.done:
+      log.CreatedResource(spoke_ref.Name(), kind='spoke')
+      return op_ref
+
+    if args.async_:
+      log.status.Print('Check operation [{}] for status.'.format(op_ref.name))
+      return op_ref
+
+    op_resource = resources.REGISTRY.ParseRelativeName(
+        op_ref.name,
+        collection='networkconnectivity.projects.locations.operations',
+        api_version=networkconnectivity_util.VERSION_MAP[self.ReleaseTrack()],
+    )
+    poller = waiter.CloudOperationPoller(
+        client.spoke_service, client.operation_service
+    )
+    res = waiter.WaitFor(
+        poller,
+        op_resource,
+        'Waiting for operation [{}] to complete'.format(op_ref.name),
+    )
+    log.CreatedResource(spoke_ref.Name(), kind='spoke')
+    return res
+
+UNIVERSE_DOMAIN = properties.VALUES.core.universe_domain.Get()
+DETAILED_HELP = {
+    'EXAMPLES': f""" \
+  To create a VPC spoke named ``myspoke'', run:
+
+    $ {{command}} myspoke --hub=https://www.{UNIVERSE_DOMAIN}/networkconnectivity/v1/projects/my-project/locations/global/hubs/my-hub \
+        --global \
+        --vpc-network=https://www.{UNIVERSE_DOMAIN}/compute/v1/projects/my-project/global/networks/my-vpc
+  """,
+    'API REFERENCE': """ \
+  This command uses the networkconnectivity/v1 API. The full documentation
+  for this API can be found at:
+  https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest
+  """,
+}
+
+Create.detailed_help = DETAILED_HELP

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/linked_vpc_network/update.py

@@ -0,0 +1,158 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Command for updating spokes."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_api
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_util
+from googlecloudsdk.api_lib.util import waiter
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.network_connectivity import flags
+from googlecloudsdk.command_lib.util.args import labels_util
+from googlecloudsdk.core import log
+from googlecloudsdk.core import resources
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.GA)
+class Update(base.Command):
+  """Update a VPC spoke.
+
+  Update the details of a VPC spoke.
+  """
+
+  @staticmethod
+  def Args(parser):
+    flags.AddSpokeResourceArg(
+        parser, 'to update', flags.ResourceLocationType.GLOBAL_ONLY
+    )
+    flags.AddRegionGroup(parser, hide_global_arg=False, hide_region_arg=True)
+    flags.AddDescriptionFlag(parser, 'New description of the spoke.')
+    flags.AddAsyncFlag(parser)
+    labels_util.AddUpdateLabelsFlags(parser)
+    flags.AddUpdateIncludeExportRangesFlag(
+        parser,
+        hide_include_export_ranges_flag=False,
+    )
+    flags.AddUpdateExcludeExportRangesFlag(
+        parser,
+        hide_exclude_export_ranges_flag=False,
+    )
+
+  def Run(self, args):
+    client = networkconnectivity_api.SpokesClient(
+        release_track=self.ReleaseTrack()
+    )
+
+    spoke_ref = args.CONCEPTS.spoke.Parse()
+    update_mask = []
+    description = args.description
+    if description is not None:
+      update_mask.append('description')
+    include_export_ranges = args.include_export_ranges
+    exclude_export_ranges = args.exclude_export_ranges
+    if include_export_ranges is not None:
+      update_mask.append('linked_vpc_network.include_export_ranges')
+    if exclude_export_ranges is not None:
+      update_mask.append('linked_vpc_network.exclude_export_ranges')
+
+    labels = None
+    labels_diff = labels_util.Diff.FromUpdateArgs(args)
+
+    if self.ReleaseTrack() == base.ReleaseTrack.BETA:
+      if labels_diff.MayHaveUpdates():
+        original_spoke = client.Get(spoke_ref)
+        labels_update = labels_diff.Apply(
+            client.messages.GoogleCloudNetworkconnectivityV1betaSpoke.LabelsValue,
+            original_spoke.labels,
+        )
+        if labels_update.needs_update:
+          labels = labels_update.labels
+          update_mask.append('labels')
+
+      spoke = client.messages.GoogleCloudNetworkconnectivityV1betaSpoke(
+          description=description, labels=labels
+      )
+      if include_export_ranges is not None or exclude_export_ranges is not None:
+        spoke.linkedVpcNetwork = (
+            client.messages.GoogleCloudNetworkconnectivityV1betaLinkedVpcNetwork()
+        )
+        if include_export_ranges is not None:
+          spoke.linkedVpcNetwork.includeExportRanges = include_export_ranges
+        if exclude_export_ranges is not None:
+          spoke.linkedVpcNetwork.excludeExportRanges = exclude_export_ranges
+      op_ref = client.UpdateSpokeBeta(spoke_ref, spoke, update_mask)
+    else:
+      if labels_diff.MayHaveUpdates():
+        original_spoke = client.Get(spoke_ref)
+        labels_update = labels_diff.Apply(
+            client.messages.Spoke.LabelsValue, original_spoke.labels
+        )
+        if labels_update.needs_update:
+          labels = labels_update.labels
+          update_mask.append('labels')
+
+      spoke = client.messages.Spoke(description=description, labels=labels)
+      if include_export_ranges is not None or exclude_export_ranges is not None:
+        spoke.linkedVpcNetwork = client.messages.LinkedVpcNetwork()
+        if include_export_ranges is not None:
+          spoke.linkedVpcNetwork.includeExportRanges = include_export_ranges
+        if exclude_export_ranges is not None:
+          spoke.linkedVpcNetwork.excludeExportRanges = exclude_export_ranges
+      op_ref = client.UpdateSpoke(spoke_ref, spoke, update_mask)
+
+    log.status.Print('Update request issued for: [{}]'.format(spoke_ref.Name()))
+
+    if op_ref.done:
+      log.UpdatedResource(spoke_ref.Name(), kind='spoke')
+      return op_ref
+
+    if args.async_:
+      log.status.Print('Check operation [{}] for status.'.format(op_ref.name))
+      return op_ref
+
+    op_resource = resources.REGISTRY.ParseRelativeName(
+        op_ref.name,
+        collection='networkconnectivity.projects.locations.operations',
+        api_version=networkconnectivity_util.VERSION_MAP[self.ReleaseTrack()],
+    )
+    poller = waiter.CloudOperationPoller(
+        client.spoke_service, client.operation_service
+    )
+    res = waiter.WaitFor(
+        poller,
+        op_resource,
+        'Waiting for operation [{}] to complete'.format(op_ref.name),
+    )
+    log.UpdatedResource(spoke_ref.Name(), kind='spoke')
+    return res
+
+
+Update.detailed_help = {
+    'EXAMPLES': """ \
+  To update the description of a global VPC spoke named ``my-spoke'', run:
+
+    $ {command} myspoke --global --description="new spoke description"
+  """,
+    'API REFERENCE': """ \
+  This command uses the networkconnectivity/v1 API. The full documentation
+  for this API can be found at:
+  https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest
+  """,
+}

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/linked_vpn_tunnels/__init__.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for VPN spokes."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.GA)
+class LinkedVpnTunnelSpokes(base.Group):
+  """Manage VPN spokes."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/linked_vpn_tunnels/create.yaml

@@ -0,0 +1,148 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: Create a new VPN spoke.
+    description: Create a new [VPN spoke](https://cloud.google.com/network-connectivity/docs/network-connectivity-center/how-to/working-with-hubs-spokes#create-vpn-spoke).
+    examples: |
+      To create a VPN spoke in region ``us-central1'' that uses data transfer and has
+      two tunnels, run:
+
+        $ {command} my-spoke --hub="https://www.googleapis.com/networkconnectivity/v1beta/projects/my-project/locations/global/hubs/my-hub" --region=us-central1 --vpn-tunnels=https://www.googleapis.com/compute/v1/projects/my-project/regions/us-central1/vpnTunnels/vpn-tunnel1,https://www.googleapis.com/compute/v1/projects/my-project/regions/us-central1/vpnTunnels/vpn-tunnel2 --site-to-site-data-transfer
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:spoke
+      help_text: Name of the spoke to be created.
+    params:
+    - arg_name: hub
+      required: true
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.hub
+      help_text: Hub that the spoke will attach to. The hub must already exist.
+    - arg_name: description
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.description
+      help_text: Description of the spoke to create.
+    - arg_name: vpn-tunnels
+      required: true
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedVpnTunnels.uris
+      type: arg_list
+      help_text: HA VPN tunnels that the spoke provides connectivity to. The resources must already exist.
+    - arg_name: site-to-site-data-transfer
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedVpnTunnels.siteToSiteDataTransfer
+      help_text: |
+        Whether to enable site-to-site data transfer for this spoke. Data transfer is available only
+        in [supported locations](https://cloud.google.com/network-connectivity/docs/network-connectivity-center/concepts/locations).
+    - arg_name: include-import-ranges
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedVpnTunnels.includeImportRanges
+      type: arg_list
+      help_text: |
+        IP address range(s) allowed to be imported from hub subnets. Only ``ALL_IPV4_RANGES`` can be
+        added to the list. If it's empty, the spoke does not import any subnets from the hub.
+    - arg_name: exclude-import-ranges
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedVpnTunnels.excludeImportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Hub routes overlapped/encompassed by exclude import ranges are excluded during import from hub.
+    - arg_name: include-export-ranges
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedVpnTunnels.includeExportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Dynamic routes fully encompassed by include export ranges are included during export to hub.
+        If it's empty, the spoke exports all dynamic routes to the hub.
+    - arg_name: exclude-export-ranges
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedVpnTunnels.excludeExportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Dynamic routes overlapped/encompassed by exclude export ranges are excluded during export to hub.
+    - arg_name: group
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.group
+      help_text: |
+        The group that the spoke will be added to. The group must already exist. If unset, the spoke
+        will be added to the ``default`` group.
+    labels:
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.labels
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request:
+    api_version: v1beta
+    method: create
+    collection: networkconnectivity.projects.locations.spokes
+
+
+- release_tracks: [GA]
+
+  help_text:
+    brief: Create a new VPN spoke.
+    description: Create a new [VPN spoke](https://cloud.google.com/network-connectivity/docs/network-connectivity-center/how-to/working-with-hubs-spokes#create-vpn-spoke).
+    examples: |
+      To create a VPN spoke in region ``us-central1'' that uses data transfer and has
+      two tunnels, run:
+
+        $ {command} my-spoke --hub="https://www.googleapis.com/networkconnectivity/v1/projects/my-project/locations/global/hubs/my-hub" --region=us-central1 --vpn-tunnels=https://www.googleapis.com/compute/v1/projects/my-project/regions/us-central1/vpnTunnels/vpn-tunnel1,https://www.googleapis.com/compute/v1/projects/my-project/regions/us-central1/vpnTunnels/vpn-tunnel2 --site-to-site-data-transfer
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:spoke
+      help_text: Name of the spoke to be created.
+    params:
+    - arg_name: hub
+      required: true
+      api_field: spoke.hub
+      help_text: Hub that the spoke will attach to. The hub must already exist.
+    - arg_name: description
+      api_field: spoke.description
+      help_text: Description of the spoke to create.
+    - arg_name: vpn-tunnels
+      required: true
+      api_field: spoke.linkedVpnTunnels.uris
+      type: arg_list
+      help_text: HA VPN tunnels that the spoke provides connectivity to. The resources must already exist.
+    - arg_name: site-to-site-data-transfer
+      api_field: spoke.linkedVpnTunnels.siteToSiteDataTransfer
+      help_text: |
+        Whether to enable site-to-site data transfer for this spoke. Data transfer is available only
+        in [supported locations](https://cloud.google.com/network-connectivity/docs/network-connectivity-center/concepts/locations).
+    - arg_name: include-import-ranges
+      api_field: spoke.linkedVpnTunnels.includeImportRanges
+      type: arg_list
+      help_text: |
+        IP address range(s) allowed to be imported from hub subnets. Only ``ALL_IPV4_RANGES`` can be
+        added to the list. If it's empty, the spoke does not import any subnets from the hub.
+    - arg_name: exclude-import-ranges
+      api_field: spoke.linkedVpnTunnels.excludeImportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Hub routes overlapped/encompassed by exclude import ranges are excluded during import from hub.
+    - arg_name: include-export-ranges
+      api_field: spoke.linkedVpnTunnels.includeExportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Dynamic routes fully encompassed by include export ranges are included during export to hub.
+        If it's empty, the spoke exports all dynamic routes to the hub.
+    - arg_name: exclude-export-ranges
+      api_field: spoke.linkedVpnTunnels.excludeExportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Dynamic routes overlapped/encompassed by exclude export ranges are excluded during export to hub.
+    - arg_name: group
+      api_field: spoke.group
+      help_text: |
+        The group that the spoke will be added to. The group must already exist. If unset, the spoke
+        will be added to the ``default`` group.
+    labels:
+      api_field: spoke.labels
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request:
+    api_version: v1
+    method: create
+    collection: networkconnectivity.projects.locations.spokes

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/linked_vpn_tunnels/update.yaml

@@ -0,0 +1,116 @@
+- release_tracks: [BETA]
+
+  help_text:
+    brief: Update a VPN spoke.
+    description: Update the details of a VPN spoke.
+
+    examples: |
+      To update the description of a VPN spoke named ``my-spoke'', run:
+
+        $ {command} my-spoke --region=us-central1 --description="new spoke description"
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:spoke
+      help_text: Name of the spoke to update.
+    params:
+    - arg_name: description
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.description
+      help_text: New description of the spoke.
+    - arg_name: include-import-ranges
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedVpnTunnels.includeImportRanges
+      type: arg_list
+      help_text: |
+        IP address range(s) allowed to be imported from hub subnets. Only ``ALL_IPV4_RANGES`` can be
+        added to the list. If it's empty, the spoke does not import any subnets from the hub.
+    - arg_name: exclude-import-ranges
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedVpnTunnels.excludeImportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Hub routes overlapped/encompassed by exclude import ranges are excluded during import from hub.
+    - arg_name: include-export-ranges
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedVpnTunnels.includeExportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Dynamic routes fully encompassed by include export ranges are included during export to hub.
+        If it's empty, the spoke exports all dynamic routes to the hub.
+    - arg_name: exclude-export-ranges
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.linkedVpnTunnels.excludeExportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Dynamic routes overlapped/encompassed by exclude export ranges are excluded during export to hub.
+    labels:
+      api_field: googleCloudNetworkconnectivityV1betaSpoke.labels
+
+  update:
+    read_modify_update: true
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request:
+    api_version: v1beta
+    collection: networkconnectivity.projects.locations.spokes
+    method: patch
+
+
+- release_tracks: [GA]
+
+  help_text:
+    brief: Update a VPN spoke.
+    description: Update the details of a VPN spoke.
+
+    examples: |
+      To update the description of a VPN spoke named ``my-spoke'', run:
+
+        $ {command} my-spoke --region=us-central1 --description="new spoke description"
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:spoke
+      help_text: Name of the spoke to update.
+    params:
+    - arg_name: description
+      api_field: spoke.description
+      help_text: New description of the spoke.
+    - arg_name: include-import-ranges
+      api_field: spoke.linkedVpnTunnels.includeImportRanges
+      type: arg_list
+      help_text: |
+        IP address range(s) allowed to be imported from hub subnets. Only ``ALL_IPV4_RANGES`` can be
+        added to the list. If it's empty, the spoke does not import any subnets from the hub.
+    - arg_name: exclude-import-ranges
+      api_field: spoke.linkedVpnTunnels.excludeImportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Hub routes overlapped/encompassed by exclude import ranges are excluded during import from hub.
+    - arg_name: include-export-ranges
+      api_field: spoke.linkedVpnTunnels.includeExportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Dynamic routes fully encompassed by include export ranges are included during export to hub.
+        If it's empty, the spoke exports all dynamic routes to the hub.
+    - arg_name: exclude-export-ranges
+      api_field: spoke.linkedVpnTunnels.excludeExportRanges
+      type: arg_list
+      hidden: true
+      help_text: |
+        Dynamic routes overlapped/encompassed by exclude export ranges are excluded during export to hub.
+    labels:
+      api_field: spoke.labels
+
+  update:
+    read_modify_update: true
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request:
+    api_version: v1
+    collection: networkconnectivity.projects.locations.spokes
+    method: patch

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/list.py

@@ -0,0 +1,77 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Command for listing spokes."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.network_connectivity import networkconnectivity_api
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.network_connectivity import flags
+from googlecloudsdk.command_lib.network_connectivity import util
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.GA)
+class List(base.ListCommand):
+  """List spokes.
+
+  Retrieve and display a list of all spokes in the specified project.
+  """
+
+  @staticmethod
+  def Args(parser):
+    # Remove URI flag to match surface spec
+    base.URI_FLAG.RemoveFromParser(parser)
+
+    # Add flags to identify region
+    flags.AddRegionResourceArg(parser, 'to display')
+    flags.AddRegionGroup(
+        parser, supports_region_wildcard=True, hide_global_arg=False)
+
+    # Table formatting
+    parser.display_info.AddFormat(util.LIST_FORMAT)
+
+  def Run(self, args):
+    client = networkconnectivity_api.SpokesClient(
+        release_track=self.ReleaseTrack())
+    region_ref = args.CONCEPTS.region.Parse()
+    return client.List(
+        region_ref,
+        limit=args.limit,
+        filter_expression=None,  # Do all filtering client-side.
+        page_size=args.page_size)
+
+
+List.detailed_help = {
+    'EXAMPLES':
+        """ \
+  To list all spokes in the ``us-central1'' region, run:
+
+        $ {command} --region=us-central1
+
+  To list all spokes in all regions, run:
+
+        $ {command}
+  """,
+    'API REFERENCE':
+        """ \
+  This command uses the networkconnectivity/v1 API. The full documentation
+  for this API can be found at:
+  https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest
+  """,
+}

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/list.yaml

@@ -0,0 +1,36 @@
+- release_tracks: [ALPHA]
+
+  help_text:
+    brief: List spokes.
+    description: Retrieve and display a list of all spokes in the specified project.
+    examples: |
+      To list all spokes in region ``us-central1'', run:
+
+        $ {command} --region=us-central1
+
+  request: &request
+    ALPHA:
+      api_version: v1alpha1
+    collection: networkconnectivity.projects.locations.spokes
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:region
+      help_text: A Google Cloud region. Use this flag to filter the list of spokes to a specific region or to all regions. Use ``-`` to specify all regions.
+
+  output:
+    ALPHA:
+      format: |
+        table(
+            name.basename(),
+            name.segment(3):label=REGION,
+            hub.basename(),
+            format(
+                "{0}{1}{2}",
+                linkedVpnTunnels.yesno(yes="VPN tunnel", no=""),
+                linkedInterconnectAttachments.yesno(yes="VLAN attachment", no=""),
+                linkedRouterApplianceInstances.yesno(yes="Router appliance", no="")
+            ):label=TYPE,
+            firstof(linkedVpnTunnels, linkedInterconnectAttachments, linkedRouterApplianceInstances).len():label="RESOURCE COUNT",
+            description
+        )

gcloud auth application-default login/google-cloud-sdk/lib/surface/network_connectivity/spokes/update.yaml

@@ -0,0 +1,55 @@
+- release_tracks: [ALPHA]
+
+  help_text:
+    brief: Update a spoke by the label.
+    description: Update the detail of a spoke.
+
+    examples: |
+      Update description of the spoke named ``my-spoke'' with description 'new spoke description' in us-central1.
+
+        $ {command} my-spoke --region=us-central1 --description="new spoke description".
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.network_connectivity.resources:spoke
+      help_text: Name of the spoke to be updated.
+    params:
+    - arg_name: description
+      api_field: spoke.description
+      help_text: New description of the spoke.
+    - arg_name: labels
+      api_field: spoke.labels.additionalProperties
+      metavar: KEY=VALUE
+      help_text: |
+        List of label KEY=VALUE pairs to add.
+      type:
+        arg_dict:
+          flatten: true
+          spec:
+          - api_field: key
+          - api_field: value
+    - arg_name: router-appliance
+      api_field: spoke.linkedRouterApplianceInstances
+      type:
+        arg_dict:
+          flatten: false
+          spec:
+          - api_field: virtualMachine
+            arg_name: instance
+            type: str
+          - api_field: ipAddress
+            arg_name: ip
+            type: str
+      help_text: |
+        Replace the set of router appliance instances linked to this spoke. Pass this flag multiple times to use multiple instances.
+        For example, use `--router-appliance=instance=new_instance,ip=10.10.10.1` for a single router-appliance instance,
+        or `--router-appliance=instance=new_instance_1,ip=10.10.10.11 --router-appliance=instance=new_instance_2,ip=10.10.10.12 ...`
+        for multiple instances.
+
+  async:
+    collection: networkconnectivity.projects.locations.operations
+
+  request:
+    api_version: v1alpha1
+    collection: networkconnectivity.projects.locations.spokes
+    method: patch