feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/__init__.py

@@ -0,0 +1,33 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for Network Services."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.BETA, base.ReleaseTrack.ALPHA, base.ReleaseTrack.GA
+)
+class ServiceExtensions(base.Group):
+  """Manage Service Extensions resources."""
+
+  category = base.NETWORKING_CATEGORY
+
+  def Filter(self, context, args):
+    del context, args

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/authz_extensions/__init__.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2024 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for Service Extensions Authz Extensions."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA, base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class AuthzPolicies(base.Group):
+  """Manage Service Extensions `AuthzExtension` resources."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/authz_extensions/delete.yaml

@@ -0,0 +1,29 @@
+release_tracks: [BETA, GA]
+
+help_text:
+  brief: |
+    Delete an `AuthzExtension` resource.
+  description: |
+    Delete the specified `AuthzExtension` resource.
+  examples: |
+      To delete an `AuthzExtension` resource named
+      `my-authz-extension` in `us-central1`, run:
+
+        $ {command} my-authz-extension --location=us-central1
+
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.service_extensions.resources:authzExtension
+    help_text: |
+      The ID of the deleted `AuthzExtension` resource.
+
+async:
+  collection: networkservices.projects.locations.operations
+
+request: &request
+  BETA:
+    api_version: v1beta1
+  GA:
+    api_version: v1
+
+  collection: networkservices.projects.locations.authzExtensions

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/authz_extensions/describe.yaml

@@ -0,0 +1,25 @@
+release_tracks: [BETA, GA]
+
+help_text:
+  brief: |
+    Describe an `AuthzExtension` resource.
+  description: |
+    Show details about an `AuthzExtension` resource.
+  examples: |
+    To show details about the `AuthzExtension` resource named
+    `my-authz-extension` located in `us-central1`.
+
+      $ {command} my-authz-extension --location=us-central1
+
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.service_extensions.resources:authzExtension
+    help_text: The ID of the `AuthzExtension` resource.
+
+request: &request
+  BETA:
+    api_version: v1beta1
+  GA:
+    api_version: v1
+
+  collection: networkservices.projects.locations.authzExtensions

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/authz_extensions/import.yaml

@@ -0,0 +1,38 @@
+release_tracks: [BETA, GA]
+help_text:
+  brief: |
+    Import an `AuthzExtension` resource.
+  description: |
+    Import an `AuthzExtension` resource defined in a YAML file.
+  examples: |
+    To import an `AuthzExtension` resource named
+    `my-authz-extension` from a YAML file in `us-central1`, run:
+
+        $ {command} my-authz-extension --source=my-authz-extension.yaml --location=us-central1
+
+request:
+  collection: networkservices.projects.locations.authzExtensions
+  BETA:
+    api_version: v1beta1
+  GA:
+    api_version: v1
+
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.service_extensions.resources:authzExtension
+    help_text: |
+      The ID of the new or updated `AuthzExtension` resource.
+
+async:
+  collection: networkservices.projects.locations.operations
+
+import:
+  abort_if_equivalent: true
+  create_if_not_exists: true
+  create_request:
+    collection: networkservices.projects.locations.authzExtensions
+    BETA:
+      api_version: v1beta1
+    GA:
+      api_version: v1
+    method: create

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/authz_extensions/list.yaml

@@ -0,0 +1,38 @@
+release_tracks: [BETA, GA]
+
+help_text:
+  brief: |
+    List `AuthzExtension` resources.
+  description: |
+    List all `AuthzExtension` resources in the specified location of the
+    current project.
+  examples: |
+      To list all `AuthzExtension` resources in the current project located
+      in `us-central1` region run:
+
+        $ {command} --location=us-central1
+
+request: &request
+  BETA:
+    api_version: v1beta1
+  GA:
+    api_version: v1
+
+  collection: networkservices.projects.locations.authzExtensions
+
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.service_extensions.resources:location
+    help_text: |
+      The parent location.
+
+response:
+  id_field: name
+
+output:
+  format: |
+      table(
+        name.basename():label=NAME,
+        loadBalancingScheme,
+        updateTime.date(unit=1000, tz_default=UTC):label=LAST_MODIFIED
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/lb_edge_extensions/__init__.py

@@ -0,0 +1,23 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google Inc. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The command group for Service Extensions LbEdgeExtension resources."""
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.GA, base.ReleaseTrack.BETA)
+@base.DefaultUniverseOnly
+class LbEdgeExtensions(base.Group):
+  """Manage Service Extensions `LbEdgeExtension` resources."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/lb_edge_extensions/delete.yaml

@@ -0,0 +1,29 @@
+release_tracks: [GA, BETA]
+
+help_text:
+  brief: |
+    Delete an `LbEdgeExtension` resource.
+  description: |
+    Delete the specified `LbEdgeExtension` resource.
+  examples: |
+      To delete a global `LbEdgeExtension` resource named
+      `my-edge-extension`, run:
+
+        $ {command} my-edge-extension --location=global
+
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.service_extensions.resources:lbEdgeExtension
+    help_text: |
+      The ID of the deleted `LbEdgeExtension` resource.
+
+async:
+  collection: networkservices.projects.locations.operations
+
+request: &request
+  BETA:
+    api_version: v1beta1
+  GA:
+    api_version: v1
+
+  collection: networkservices.projects.locations.lbEdgeExtensions

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/lb_edge_extensions/describe.yaml

@@ -0,0 +1,25 @@
+release_tracks: [GA, BETA]
+
+help_text:
+  brief: |
+    Describe an `LbEdgeExtension` resource.
+  description: |
+    Show details about an `LbEdgeExtension` resource.
+  examples: |
+    To show details about the global `LbEdgeExtension` resource named
+    `my-edge-extension`.
+
+      $ {command} my-edge-extension --location=global
+
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.service_extensions.resources:lbEdgeExtension
+    help_text: The ID of the `LbEdgeExtension` resource.
+
+request: &request
+  BETA:
+    api_version: v1beta1
+  GA:
+    api_version: v1
+
+  collection: networkservices.projects.locations.lbEdgeExtensions

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/lb_edge_extensions/import.yaml

@@ -0,0 +1,39 @@
+release_tracks: [GA, BETA]
+help_text:
+  brief: |
+    Import an `LbEdgeExtension` resource.
+  description: |
+    Import an `LbEdgeExtension` resource defined in a YAML file.
+  examples: |
+    To import a global `LbEdgeExtension` resource named
+    `my-edge-extension` from a YAML file, run:
+
+        $ {command} my-edge-extension --source=my-edge-extension.yaml --location=global
+
+request:
+  collection: networkservices.projects.locations.lbEdgeExtensions
+  BETA:
+    api_version: v1beta1
+  GA:
+    api_version: v1
+
+
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.service_extensions.resources:lbEdgeExtension
+    help_text: |
+      The ID of the new or updated `LbEdgeExtension` resource.
+
+async:
+  collection: networkservices.projects.locations.operations
+
+import:
+  abort_if_equivalent: true
+  create_if_not_exists: true
+  create_request:
+    collection: networkservices.projects.locations.lbEdgeExtensions
+    BETA:
+      api_version: v1beta1
+    GA:
+      api_version: v1
+    method: create

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/lb_edge_extensions/list.yaml

@@ -0,0 +1,37 @@
+release_tracks: [GA, BETA]
+
+help_text:
+  brief: |
+    List `LbEdgeExtension` resources.
+  description: |
+    List all `LbEdgeExtension` resources in the specified location of the
+    current project.
+  examples: |
+      To list all global `LbEdgeExtension` resources in the current project, run:
+
+        $ {command} --location=global
+
+request: &request
+  BETA:
+    api_version: v1beta1
+  GA:
+    api_version: v1
+
+  collection: networkservices.projects.locations.lbEdgeExtensions
+
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.service_extensions.resources:location
+    help_text: |
+      The parent location.
+
+response:
+  id_field: name
+
+output:
+  format: |
+      table(
+        name.basename():label=NAME,
+        loadBalancingScheme,
+        updateTime.date(unit=1000, tz_default=UTC):label=LAST_MODIFIED
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/lb_observability_extensions/__init__.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2024 Google Inc. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The wasm-actions command group for Network Actions."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+@base.Hidden
+class LbObservabilityExtensions(base.Group):
+  """Manage Service Extensions `LbObservabilityExtension` resources."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/lb_observability_extensions/delete.yaml

@@ -0,0 +1,26 @@
+release_tracks: [ALPHA]
+
+help_text:
+  brief: |
+    Delete an `LbObservabilityExtension` resource.
+  description: |
+    Delete the specified `LbObservabilityExtension` resource.
+  examples: |
+      To delete an `LbObservabilityExtension` resource named
+      `my-observability-extension` in `us-central1`, run:
+
+        $ {command} my-observability-extension --location=us-central1
+
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.service_extensions.resources:lbObservabilityExtension
+    help_text: |
+      The ID of the deleted `LbObservabilityExtension` resource.
+
+async:
+  collection: networkservices.projects.locations.operations
+
+request: &request
+  ALPHA:
+    api_version: v1alpha1
+  collection: networkservices.projects.locations.lbObservabilityExtensions

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/lb_observability_extensions/describe.yaml

@@ -0,0 +1,22 @@
+release_tracks: [ALPHA]
+
+help_text:
+  brief: |
+    Describe an `LbObservabilityExtension` resource.
+  description: |
+    Show details about an `LbObservabilityExtension` resource.
+  examples: |
+    To show details about the `LbObservabilityExtension` resource named
+    `my-observability-extension` located in `us-central1`.
+
+      $ {command} my-observability-extension --location=us-central1
+
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.service_extensions.resources:lbObservabilityExtension
+    help_text: The ID of the `LbObservabilityExtension` resource.
+
+request: &request
+  ALPHA:
+    api_version: v1alpha1
+  collection: networkservices.projects.locations.lbObservabilityExtensions

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/lb_observability_extensions/import.yaml

@@ -0,0 +1,34 @@
+release_tracks: [ALPHA]
+help_text:
+  brief: |
+    Import an `LbObservabilityExtension` resource.
+  description: |
+    Import an `LbObservabilityExtension` resource defined in a YAML file.
+  examples: |
+    To import an `LbObservabilityExtension` resource named
+    `my-observability-extension` from a YAML file in `us-central1`, run:
+
+        $ {command} my-observability-extension --source=my-observability-extension.yaml --location=us-central1
+
+request:
+  collection: networkservices.projects.locations.lbObservabilityExtensions
+  ALPHA:
+    api_version: v1alpha1
+
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.service_extensions.resources:lbObservabilityExtension
+    help_text: |
+      The ID of the new or updated `LbObservabilityExtension` resource.
+
+async:
+  collection: networkservices.projects.locations.operations
+
+import:
+  abort_if_equivalent: true
+  create_if_not_exists: true
+  create_request:
+    collection: networkservices.projects.locations.lbObservabilityExtensions
+    ALPHA:
+      api_version: v1alpha1
+    method: create

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/lb_observability_extensions/list.yaml

@@ -0,0 +1,35 @@
+release_tracks: [ALPHA]
+
+help_text:
+  brief: |
+    List `LbObservabilityExtension` resources.
+  description: |
+    List all `LbObservabilityExtension` resources in the specified location of the
+    current project.
+  examples: |
+      To list all `LbObservabilityExtension` resources in the current project located
+      in `us-central1` region run:
+
+        $ {command} --location=us-central1
+
+request: &request
+  ALPHA:
+    api_version: v1alpha1
+  collection: networkservices.projects.locations.lbObservabilityExtensions
+
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.service_extensions.resources:location
+    help_text: |
+      The parent location.
+
+response:
+  id_field: name
+
+output:
+  format: |
+      table(
+        name.basename():label=NAME,
+        loadBalancingScheme,
+        updateTime.date(unit=1000, tz_default=UTC):label=LAST_MODIFIED
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/lb_route_extensions/__init__.py

@@ -0,0 +1,28 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google Inc. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The wasm-actions command group for Network Actions."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.BETA, base.ReleaseTrack.ALPHA, base.ReleaseTrack.GA
+)
+class LbRouteExtensions(base.Group):
+  """Manage Service Extensions `LbRouteExtension` resources."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/lb_route_extensions/delete.yaml

@@ -0,0 +1,31 @@
+release_tracks: [ALPHA, BETA, GA]
+
+help_text:
+  brief: |
+    Delete an `LbRouteExtension` resource.
+  description: |
+    Delete the specified `LbRouteExtension` resource.
+  examples: |
+      To delete an `LbRouteExtension` resource named
+      `my-route-extension` in `us-central1`, run:
+
+        $ {command} my-route-extension --location=us-central1
+
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.service_extensions.resources:lbRouteExtension
+    help_text: |
+      The ID of the deleted `LbRouteExtension` resource.
+
+async:
+  collection: networkservices.projects.locations.operations
+
+request: &request
+  ALPHA:
+    api_version: v1alpha1
+  BETA:
+    api_version: v1beta1
+  GA:
+    api_version: v1
+
+  collection: networkservices.projects.locations.lbRouteExtensions

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/lb_route_extensions/describe.yaml

@@ -0,0 +1,27 @@
+release_tracks: [ALPHA, BETA, GA]
+
+help_text:
+  brief: |
+    Describe an `LbRouteExtension` resource.
+  description: |
+    Show details about an `LbRouteExtension` resource.
+  examples: |
+    To show details about the `LbRouteExtension` resource named
+    `my-route-extension` located in `us-central1`.
+
+      $ {command} my-route-extension --location=us-central1
+
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.service_extensions.resources:lbRouteExtension
+    help_text: The ID of the `LbRouteExtension` resource.
+
+request: &request
+  ALPHA:
+    api_version: v1alpha1
+  BETA:
+    api_version: v1beta1
+  GA:
+    api_version: v1
+
+  collection: networkservices.projects.locations.lbRouteExtensions

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/lb_route_extensions/import.yaml

@@ -0,0 +1,43 @@
+release_tracks: [ALPHA, BETA, GA]
+help_text:
+  brief: |
+    Import an `LbRouteExtension` resource.
+  description: |
+    Import an `LbRouteExtension` resource defined in a YAML file.
+  examples: |
+    To import an `LbRouteExtension` resource named
+    `my-route-extension` from a YAML file in `us-central1`, run:
+
+        $ {command} my-route-extension --source=my-route-extension.yaml --location=us-central1
+
+request:
+  collection: networkservices.projects.locations.lbRouteExtensions
+  ALPHA:
+    api_version: v1alpha1
+  BETA:
+    api_version: v1beta1
+  GA:
+    api_version: v1
+
+
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.service_extensions.resources:lbRouteExtension
+    help_text: |
+      The ID of the new or updated `LbRouteExtension` resource.
+
+async:
+  collection: networkservices.projects.locations.operations
+
+import:
+  abort_if_equivalent: true
+  create_if_not_exists: true
+  create_request:
+    collection: networkservices.projects.locations.lbRouteExtensions
+    ALPHA:
+      api_version: v1alpha1
+    BETA:
+      api_version: v1beta1
+    GA:
+      api_version: v1
+    method: create

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/lb_route_extensions/list.yaml

@@ -0,0 +1,40 @@
+release_tracks: [ALPHA, BETA, GA]
+
+help_text:
+  brief: |
+    List `LbRouteExtension` resources.
+  description: |
+    List all `LbRouteExtension` resources in the specified location of the
+    current project.
+  examples: |
+      To list all `LbRouteExtension` resources in the current project located
+      in `us-central1` region run:
+
+        $ {command} --location=us-central1
+
+request: &request
+  ALPHA:
+    api_version: v1alpha1
+  BETA:
+    api_version: v1beta1
+  GA:
+    api_version: v1
+
+  collection: networkservices.projects.locations.lbRouteExtensions
+
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.service_extensions.resources:location
+    help_text: |
+      The parent location.
+
+response:
+  id_field: name
+
+output:
+  format: |
+      table(
+        name.basename():label=NAME,
+        loadBalancingScheme,
+        updateTime.date(unit=1000, tz_default=UTC):label=LAST_MODIFIED
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/lb_tcp_extensions/__init__.py

@@ -0,0 +1,24 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google Inc. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The command group for Service Extensions LbTcpExtension resources."""
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.BETA)
+@base.DefaultUniverseOnly
+@base.Hidden
+class LbTcpExtensions(base.Group):
+  """Manage Service Extensions `LbTcpExtension` resources."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/lb_tcp_extensions/delete.yaml

@@ -0,0 +1,27 @@
+release_tracks: [BETA]
+
+help_text:
+  brief: |
+    Delete an `LbTcpExtension` resource.
+  description: |
+    Delete the specified `LbTcpExtension` resource.
+  examples: |
+      To delete an `LbTcpExtension` resource named
+      `my-tcp-extension` in `us-central1`, run:
+
+        $ {command} my-tcp-extension --location=us-central1
+
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.service_extensions.resources:lbTcpExtension
+    help_text: |
+      The ID of the deleted `LbTcpExtension` resource.
+
+async:
+  collection: networkservices.projects.locations.operations
+
+request: &request
+  BETA:
+    api_version: v1beta1
+
+  collection: networkservices.projects.locations.lbTcpExtensions

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/lb_tcp_extensions/describe.yaml

@@ -0,0 +1,23 @@
+release_tracks: [BETA]
+
+help_text:
+  brief: |
+    Describe an `LbTcpExtension` resource.
+  description: |
+    Show details about an `LbTcpExtension` resource.
+  examples: |
+    To show details about the `LbTcpExtension` resource named
+    `my-tcp-extension` located in `us-central1`.
+
+      $ {command} my-tcp-extension --location=us-central1
+
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.service_extensions.resources:lbTcpExtension
+    help_text: The ID of the `LbTcpExtension` resource.
+
+request: &request
+  BETA:
+    api_version: v1beta1
+
+  collection: networkservices.projects.locations.lbTcpExtensions

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/lb_tcp_extensions/import.yaml

@@ -0,0 +1,35 @@
+release_tracks: [BETA]
+help_text:
+  brief: |
+    Import an `LbTcpExtension` resource.
+  description: |
+    Import an `LbTcpExtension` resource defined in a YAML file.
+  examples: |
+    To import an `LbTcpExtension` resource named
+    `my-tcp-extension` from a YAML file in `us-central1`, run:
+
+        $ {command} my-tcp-extension --source=my-tcp-extension.yaml --location=us-central1
+
+request:
+  collection: networkservices.projects.locations.lbTcpExtensions
+  BETA:
+    api_version: v1beta1
+
+
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.service_extensions.resources:lbTcpExtension
+    help_text: |
+      The ID of the new or updated `LbTcpExtension` resource.
+
+async:
+  collection: networkservices.projects.locations.operations
+
+import:
+  abort_if_equivalent: true
+  create_if_not_exists: true
+  create_request:
+    collection: networkservices.projects.locations.lbTcpExtensions
+    BETA:
+      api_version: v1beta1
+    method: create

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/lb_tcp_extensions/list.yaml

@@ -0,0 +1,36 @@
+release_tracks: [BETA]
+
+help_text:
+  brief: |
+    List `LbTcpExtension` resources.
+  description: |
+    List all `LbTcpExtension` resources in the specified location of the
+    current project.
+  examples: |
+      To list all `LbTcpExtension` resources in the current project located
+      in `us-central1` region run:
+
+        $ {command} --location=us-central1
+
+request: &request
+  BETA:
+    api_version: v1beta1
+
+  collection: networkservices.projects.locations.lbTcpExtensions
+
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.service_extensions.resources:location
+    help_text: |
+      The parent location.
+
+response:
+  id_field: name
+
+output:
+  format: |
+      table(
+        name.basename():label=NAME,
+        loadBalancingScheme,
+        updateTime.date(unit=1000, tz_default=UTC):label=LAST_MODIFIED
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/lb_traffic_extensions/__init__.py

@@ -0,0 +1,28 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google Inc. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The wasm-actions command group for Network Actions."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.BETA, base.ReleaseTrack.ALPHA, base.ReleaseTrack.GA
+)
+class LbTrafficExtensions(base.Group):
+  """Manage Service Extensions `LbTrafficExtension` resources."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/lb_traffic_extensions/delete.yaml

@@ -0,0 +1,31 @@
+release_tracks: [ALPHA, BETA, GA]
+
+help_text:
+  brief: |
+    Delete an `LbTrafficExtension` resource.
+  description: |
+    Delete the specified `LbTrafficExtension` resource.
+  examples: |
+      To delete an `LbTrafficExtension` resource named `my-traffic-extension` in
+      `us-central1`, run:
+
+        $ {command} my-traffic-extension --location=us-central1
+
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.service_extensions.resources:lbTrafficExtension
+    help_text: |
+      The ID of the deleted `LbTrafficExtension` resource.
+
+async:
+  collection: networkservices.projects.locations.operations
+
+request: &request
+  ALPHA:
+    api_version: v1alpha1
+  BETA:
+    api_version: v1beta1
+  GA:
+    api_version: v1
+
+  collection: networkservices.projects.locations.lbTrafficExtensions

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/lb_traffic_extensions/describe.yaml

@@ -0,0 +1,27 @@
+release_tracks: [ALPHA, BETA, GA]
+
+help_text:
+  brief: |
+    Describe an `LbTrafficExtension` resource.
+  description: |
+    Show details of an `LbTrafficExtension` resource.
+  examples: |
+      To show details about the `LbTrafficExtension` resource named
+      `my-traffic-extension` located in `us-central1`.
+
+        $ {command} my-traffic-extension --location=us-central1
+
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.service_extensions.resources:lbTrafficExtension
+    help_text: The ID of the `LbTrafficExtension` resource.
+
+request: &request
+  ALPHA:
+    api_version: v1alpha1
+  BETA:
+    api_version: v1beta1
+  GA:
+    api_version: v1
+
+  collection: networkservices.projects.locations.lbTrafficExtensions

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/lb_traffic_extensions/import.yaml

@@ -0,0 +1,42 @@
+release_tracks: [ALPHA, BETA, GA]
+help_text:
+  brief: |
+    Import an `LbTrafficExtension` resource.
+  description: |
+    Import an `LbTrafficExtension` resource defined in a YAML file.
+  examples: |
+    To import an `LbTrafficExtension` resource named `my-traffic-extension` from a YAML file
+    in `us-central1`, run:
+
+        $ {command} my-traffic-extension --source=my-traffic-extension.yaml --location=us-central1
+
+request:
+  collection: networkservices.projects.locations.lbTrafficExtensions
+  ALPHA:
+    api_version: v1alpha1
+  BETA:
+    api_version: v1beta1
+  GA:
+    api_version: v1
+
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.service_extensions.resources:lbTrafficExtension
+    help_text: |
+      The ID of the new or updated `LbTrafficExtension` resource.
+
+async:
+  collection: networkservices.projects.locations.operations
+
+import:
+  abort_if_equivalent: true
+  create_if_not_exists: true
+  create_request:
+    collection: networkservices.projects.locations.lbTrafficExtensions
+    ALPHA:
+      api_version: v1alpha1
+    BETA:
+      api_version: v1beta1
+    GA:
+      api_version: v1
+    method: create

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/lb_traffic_extensions/list.yaml

@@ -0,0 +1,41 @@
+release_tracks: [ALPHA, BETA, GA]
+
+help_text:
+  brief: |
+    List `LbTrafficExtension` resources.
+  description: |
+    List all `LbTrafficExtension` resources in the specified location of the current
+    project.
+  examples: |
+      To list all `LbTrafficExtension` resources in the current project located in
+      `us-central1` region, run:
+
+        $ {command} --location=us-central1
+
+
+request: &request
+  ALPHA:
+    api_version: v1alpha1
+  BETA:
+    api_version: v1beta1
+  GA:
+    api_version: v1
+
+  collection: networkservices.projects.locations.lbTrafficExtensions
+
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.service_extensions.resources:location
+    help_text: |
+      The parent location.
+
+response:
+  id_field: name
+
+output:
+  format: |
+     table(
+        name.basename():label=NAME,
+        loadBalancingScheme,
+        updateTime.date(unit=1000, tz_default=UTC):label=LAST_MODIFIED
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/swp_security_extensions/__init__.py

@@ -0,0 +1,24 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google Inc. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The command group for Service Extensions SwpSecurityExtension resources."""
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+@base.DefaultUniverseOnly
+@base.Hidden
+class SwpSecurityExtensions(base.Group):
+  """Manage Service Extensions `SwpSecurityExtension` resources."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/swp_security_extensions/delete.yaml

@@ -0,0 +1,27 @@
+release_tracks: [ALPHA]
+
+help_text:
+  brief: |
+    Delete an `SwpSecurityExtension` resource.
+  description: |
+    Delete the specified `SwpSecurityExtension` resource.
+  examples: |
+      To delete an `SwpSecurityExtension` resource named
+      `my-swp-security-extension` in `us-central1`, run:
+
+        $ {command} my-swp-security-extension --location=us-central1
+
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.service_extensions.resources:swpSecurityExtension
+    help_text: |
+      The ID of the deleted `SwpSecurityExtension` resource.
+
+async:
+  collection: networkservices.projects.locations.operations
+
+request: &request
+  ALPHA:
+    api_version: v1alpha1
+
+  collection: networkservices.projects.locations.swpSecurityExtensions

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/swp_security_extensions/describe.yaml

@@ -0,0 +1,23 @@
+release_tracks: [ALPHA]
+
+help_text:
+  brief: |
+    Describe an `SwpSecurityExtension` resource.
+  description: |
+    Show details about an `SwpSecurityExtension` resource.
+  examples: |
+    To show details about the `SwpSecurityExtension` resource named
+    `my-swp-security-extension` located in `us-central1`.
+
+      $ {command} my-swp-security-extension --location=us-central1
+
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.service_extensions.resources:swpSecurityExtension
+    help_text: The ID of the `SwpSecurityExtension` resource.
+
+request: &request
+  ALPHA:
+    api_version: v1alpha1
+
+  collection: networkservices.projects.locations.swpSecurityExtensions

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/swp_security_extensions/import.yaml

@@ -0,0 +1,35 @@
+release_tracks: [ALPHA]
+help_text:
+  brief: |
+    Import an `SwpSecurityExtension` resource.
+  description: |
+    Import an `SwpSecurityExtension` resource defined in a YAML file.
+  examples: |
+    To import an `SwpSecurityExtension` resource named
+    `my-swp-security-extension` from a YAML file in `us-central1`, run:
+
+        $ {command} my-swp-security-extension --source=my-swp-security-extension.yaml --location=us-central1
+
+request:
+  collection: networkservices.projects.locations.swpSecurityExtensions
+  ALPHA:
+    api_version: v1alpha1
+
+
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.service_extensions.resources:swpSecurityExtension
+    help_text: |
+      The ID of the new or updated `SwpSecurityExtension` resource.
+
+async:
+  collection: networkservices.projects.locations.operations
+
+import:
+  abort_if_equivalent: true
+  create_if_not_exists: true
+  create_request:
+    collection: networkservices.projects.locations.swpSecurityExtensions
+    ALPHA:
+      api_version: v1alpha1
+    method: create

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/swp_security_extensions/list.yaml

@@ -0,0 +1,35 @@
+release_tracks: [ALPHA]
+
+help_text:
+  brief: |
+    List `SwpSecurityExtension` resources.
+  description: |
+    List all `SwpSecurityExtension` resources in the specified location of the
+    current project.
+  examples: |
+      To list all `SwpSecurityExtension` resources in the current project located
+      in `us-central1` region run:
+
+        $ {command} --location=us-central1
+
+request: &request
+  ALPHA:
+    api_version: v1alpha1
+
+  collection: networkservices.projects.locations.swpSecurityExtensions
+
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.service_extensions.resources:location
+    help_text: |
+      The parent location.
+
+response:
+  id_field: name
+
+output:
+  format: |
+      table(
+        name.basename():label=NAME,
+        updateTime.date(unit=1000, tz_default=UTC):label=LAST_MODIFIED
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/wasm_actions/__init__.py

@@ -0,0 +1,26 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google Inc. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The wasm-actions command group for Service Extensions."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class WasmActions(base.Group):
+  """Interact with and manage Service Extensions `WasmActions`."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/wasm_actions/create.py

@@ -0,0 +1,185 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""gcloud service-extensions wasm-actions create command."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+import textwrap
+
+from googlecloudsdk.api_lib.util import apis
+from googlecloudsdk.api_lib.util import waiter
+from googlecloudsdk.calliope import arg_parsers
+from googlecloudsdk.calliope import base
+from googlecloudsdk.calliope.concepts import concepts
+from googlecloudsdk.command_lib.service_extensions import flags
+from googlecloudsdk.command_lib.service_extensions import util
+from googlecloudsdk.command_lib.util.apis import yaml_data
+from googlecloudsdk.command_lib.util.args import labels_util
+from googlecloudsdk.command_lib.util.concepts import concept_parsers
+from googlecloudsdk.command_lib.util.concepts import presentation_specs
+from googlecloudsdk.core import log
+from googlecloudsdk.core import resources
+
+
+def _GetPossibleValuesOfSupportedEvents():
+  """Returns the possible values of the --supported-events flag.
+
+  Returns:
+    List of strings.
+  """
+  return ['request-headers', 'response-headers']
+
+
+def _ConvertStringSupportedEventToEnum(messages, supported_event):
+  """Converts the text representation of an event to enum.
+
+  Args:
+    messages: module containing the definitions of messages for the API.
+    supported_event: string, for example 'request_headers'.
+
+  Returns:
+    a value of messages.WasmAction.SupportedEventsValueListEntryValuesEnum,
+    for example
+    messages.WasmAction.SupportedEventsValueListEntryValuesEnum.REQUEST_HEADERS
+  """
+  uppercase_event = supported_event.upper().replace('-', '_')
+  if not hasattr(messages.WasmAction.SupportedEventsValueListEntryValuesEnum,
+                 uppercase_event):
+    # This is theoretically possible if the list of allowed values of
+    # --supported-events (returned by _GetPossibleValuesOfSupportedEvents())
+    # contains values from the v1alpha1 version that are not yet visible
+    # in v1.
+    raise ValueError('Unsupported value: ' + supported_event)
+  return getattr(messages.WasmAction.SupportedEventsValueListEntryValuesEnum,
+                 uppercase_event)
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class Create(base.CreateCommand):
+  """Create a `WasmAction` resource."""
+
+  detailed_help = {
+      'DESCRIPTION':
+          textwrap.dedent("""\
+          Create a `WasmAction` resource that uses the specified plugin.
+          """),
+      'EXAMPLES':
+          textwrap.dedent("""\
+          To create a `WasmAction` called `my-action` using the
+          `my-plugin` plugin, run:
+
+          $ {command} my-action --wasm-plugin=my-plugin
+
+          You may also specify the full resource path to a plugin, for example,
+          `projects/my-project/locations/global/wasmPlugins/my-plugin`
+          """)
+  }
+
+  @classmethod
+  def Args(cls, parser):
+    wasm_action_data = yaml_data.ResourceYAMLData.FromPath(
+        'service_extensions.wasmAction')
+    wasm_plugin_data = yaml_data.ResourceYAMLData.FromPath(
+        'service_extensions.wasmPlugin')
+
+    # Register the wasm_action and --wasm-plugin resource args. They
+    # both provide a --location flag, so to avoid a conflict, we
+    # configure --wasm-plugin to use wasm_action's location flag.
+    concept_parsers.ConceptParser(
+        [
+            presentation_specs.ResourcePresentationSpec(
+                'wasm_action',
+                concepts.ResourceSpec.FromYaml(
+                    wasm_action_data.GetData(),
+                    api_version=util.GetApiVersion(cls.ReleaseTrack())),
+                'The ID of the `WasmAction`.',
+                required=True),
+            presentation_specs.ResourcePresentationSpec(
+                '--wasm-plugin',
+                concepts.ResourceSpec.FromYaml(
+                    wasm_plugin_data.GetData(),
+                    api_version=util.GetApiVersion(cls.ReleaseTrack())),
+                'ID of the `WasmPlugin` to use for this action.',
+                flag_name_overrides={'location': ''},
+                required=True)
+        ],
+        command_level_fallthroughs={
+            '--wasm-plugin.location': ['wasm_action.location']
+        }).AddToParser(parser)
+
+    parser.add_argument(
+        '--supported-events',
+        type=arg_parsers.ArgList(choices=_GetPossibleValuesOfSupportedEvents()),
+        required=False,
+        metavar='EVENT',
+        default=[],
+        help=textwrap.dedent("""\
+          Specify the portion of the request/response payload to be processed by
+          the plugin."""),
+    )
+    base.ASYNC_FLAG.AddToParser(parser)
+    labels_util.AddCreateLabelsFlags(parser)
+    flags.AddDescriptionFlag(parser)
+
+  def Run(self, args):
+    api_version = util.GetApiVersion(self.ReleaseTrack())
+    messages = apis.GetMessagesModule('networkservices', api_version)
+
+    wasm_action_ref = args.CONCEPTS.wasm_action.Parse()
+    wasm_plugin_ref = args.CONCEPTS.wasm_plugin.Parse()
+    labels = labels_util.ParseCreateArgs(args, messages.WasmAction.LabelsValue)
+
+    converted_events = [
+        _ConvertStringSupportedEventToEnum(messages, event)
+        for event in args.supported_events]
+
+    request = messages.NetworkservicesProjectsLocationsWasmActionsCreateRequest(
+        parent=wasm_action_ref.Parent().RelativeName(),
+        wasmActionId=wasm_action_ref.Name(),
+        wasmAction=messages.WasmAction(
+            wasmPlugin=wasm_plugin_ref.RelativeName(),
+            description=args.description,
+            labels=labels,
+            supportedEvents=converted_events,
+        ),
+    )
+
+    # Issue the create request, which returns an operation.
+    client = apis.GetClientInstance('networkservices', api_version)
+    op_ref = client.projects_locations_wasmActions.Create(request)
+
+    log.status.Print('Create request issued for: [{}]'.format(
+        wasm_action_ref.Name()))
+
+    if args.async_:
+      log.status.Print('Check operation [{}] for status.'.format(op_ref.name))
+      return op_ref
+
+    # Wait for the operation to complete.
+    op_resource = resources.REGISTRY.ParseRelativeName(
+        op_ref.name,
+        collection='networkservices.projects.locations.operations',
+        api_version=api_version)
+    poller = waiter.CloudOperationPoller(client.projects_locations_wasmActions,
+                                         client.projects_locations_operations)
+    result = waiter.WaitFor(
+        poller, op_resource,
+        'Waiting for operation [{}] to complete'.format(op_ref.name))
+
+    log.status.Print('Created WasmAction [{}].'.format(wasm_action_ref.Name()))
+
+    return result

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/wasm_actions/delete.yaml

@@ -0,0 +1,22 @@
+- release_tracks: [ALPHA]
+  help_text:
+    brief: Delete a `WasmAction` resource.
+    description: |
+      Delete a `WasmAction` resource.
+    examples: |
+      To delete a `WasmAction` called 'my-wasm-action', run:
+
+        $ {command} my-wasm-action
+
+  request:
+    collection: networkservices.projects.locations.wasmActions
+    ALPHA:
+      api_version: v1alpha1
+
+  async:
+    collection: networkservices.projects.locations.operations
+
+  arguments:
+    resource:
+      help_text: The `WasmAction` to delete.
+      spec: !REF googlecloudsdk.command_lib.service_extensions.resources:wasmAction

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/wasm_actions/describe.yaml

@@ -0,0 +1,18 @@
+- release_tracks: [ALPHA]
+  help_text:
+    brief: Show details about a `WasmAction` resource.
+    description: Show details about a `WasmAction` resource.
+    examples: |
+      To show details about a `WasmAction`, run:
+
+        $ {command} my-wasm-action
+
+  request:
+    collection: networkservices.projects.locations.wasmActions
+    ALPHA:
+      api_version: v1alpha1
+
+  arguments:
+    resource:
+      help_text: The `WasmAction` resource that you want to describe.
+      spec: !REF googlecloudsdk.command_lib.service_extensions.resources:wasmAction

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/wasm_actions/list.yaml

@@ -0,0 +1,29 @@
+- release_tracks: [ALPHA]
+  help_text:
+    brief: List all `WasmAction` resources.
+    description: |
+      List `WasmAction` resources.
+    examples: |
+      To list existing `WasmAction` resources, run:
+
+        $ {command}
+
+  request:
+    collection: networkservices.projects.locations.wasmActions
+    ALPHA:
+      api_version: v1alpha1
+
+  response:
+    id_field: name
+
+  arguments:
+    resource:
+      help_text: The parent location.
+      spec: !REF googlecloudsdk.command_lib.service_extensions.resources:optionalLocation
+
+  output:
+    format: |
+      table(
+        name.basename():label=NAME,
+        wasm_plugin:label=WASMPLUGIN
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/wasm_plugin_versions/__init__.py

@@ -0,0 +1,29 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google Inc. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The wasm-plugin-versions command group for Service Extensions."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+class WasmPluginVersions(base.Group):
+  """Interact with and manage Service Extensions `WasmPluginVersions`."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/wasm_plugin_versions/create.yaml

@@ -0,0 +1,48 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: Create a `WasmPluginVersion` resource.
+    description: |
+      Create a new `WasmPluginVersion` resource.
+    examples: |
+      To create a `WasmPluginVersion` called `my-plugin-version`, run:
+
+        $ {command} my-plugin-version --wasm-plugin=my-plugin
+        --image=...-docker.pkg.dev/my-project/repository/container:tag
+
+  request:
+    collection: networkservices.projects.locations.wasmPlugins.versions
+    ALPHA:
+      api_version: v1alpha1
+    BETA:
+      api_version: v1beta1
+    GA:
+      api_version: v1
+
+  async:
+    collection: networkservices.projects.locations.operations
+
+  arguments:
+    resource:
+      help_text: The ID of the `WasmPluginVersion` resource to create.
+      spec: !REF googlecloudsdk.command_lib.service_extensions.resources:wasmPluginVersion
+      is_positional: true
+    params:
+    - _REF_: googlecloudsdk.command_lib.service_extensions.flags:wasmPluginVersion.image
+    - group:
+        help_text: |
+          Configuration for the plugin, provided at runtime by the `on_configure` function
+          (Rust Proxy-Wasm SDK) or the `onConfigure` method (C++ Proxy-Wasm SDK).
+        mutex: true
+        params:
+        - arg_name: plugin-config
+          api_field: wasmPluginVersion.pluginConfigData
+          help_text: |
+            Plugin configuration in the textual format.
+        - arg_name: plugin-config-file
+          api_field: wasmPluginVersion.pluginConfigData
+          type: "googlecloudsdk.calliope.arg_parsers:FileContents:binary=True"
+          help_text: |
+            Path to a file containing the plugin configuration.
+        - _REF_: googlecloudsdk.command_lib.service_extensions.flags:wasmPluginVersion.pluginConfigUri
+    - _REF_: googlecloudsdk.command_lib.service_extensions.flags:wasmPluginVersion.description
+    - _REF_: googlecloudsdk.command_lib.service_extensions.flags:wasmPluginVersion.labels

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/wasm_plugin_versions/delete.yaml

@@ -0,0 +1,27 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: Delete a `WasmPluginVersion` resource.
+    description: |
+      Delete a `WasmPluginVersion` resource.
+    examples: |
+      To delete a `WasmPluginVersion` called 'my-plugin-version', run:
+
+        $ {command} my-plugin-version
+
+  request:
+    collection: networkservices.projects.locations.wasmPlugins.versions
+    ALPHA:
+      api_version: v1alpha1
+    BETA:
+      api_version: v1beta1
+    GA:
+      api_version: v1
+
+  async:
+    collection: networkservices.projects.locations.operations
+
+  arguments:
+    resource:
+      help_text: The `WasmPluginVersion` resource to delete.
+      spec: !REF googlecloudsdk.command_lib.service_extensions.resources:wasmPluginVersion
+      is_positional: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/wasm_plugin_versions/describe.yaml

@@ -0,0 +1,35 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: Show details about a `WasmPluginVersion` resource.
+    description: Show details about a `WasmPluginVersion` resource.
+    examples: |
+      To show details about a `WasmPluginVersion`, run:
+
+        $ {command} my-plugin-version
+
+  request:
+    collection: networkservices.projects.locations.wasmPlugins.versions
+    ALPHA:
+      api_version: v1alpha1
+    BETA:
+      api_version: v1beta1
+    GA:
+      api_version: v1
+
+  arguments:
+    resource:
+      help_text: The `WasmPluginVersion` resource that you want to describe.
+      spec: !REF googlecloudsdk.command_lib.service_extensions.resources:wasmPluginVersion
+      is_positional: true
+
+  output:
+    format: |
+      default(
+        name,
+        imageUri,
+        imageDigest,
+        pluginConfigData.trailoff(80),
+        pluginConfigUri,
+        pluginConfigDigest,
+        updateTime
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/wasm_plugin_versions/list.yaml

@@ -0,0 +1,39 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: List all `WasmPluginVersion` resources for a `WasmPlugin`.
+    description: |
+      List `WasmPluginVersion` resources.
+    examples: |
+      To list existing `WasmPluginVersion` resources, run:
+
+        $ {command} --wasm-plugin=WASM_PLUGIN
+
+  request:
+    collection: networkservices.projects.locations.wasmPlugins.versions
+    ALPHA:
+      api_version: v1alpha1
+    BETA:
+      api_version: v1beta1
+    GA:
+      api_version: v1
+
+  response:
+    id_field: name
+
+  arguments:
+    resource:
+      help_text: The parent `WasmPlugin`.
+      spec: !REF googlecloudsdk.command_lib.service_extensions.resources:wasmPlugin
+      is_positional: false
+
+  output:
+    format: |
+      table(
+        name.basename():label=NAME,
+        image_uri:label=WASM_IMAGE,
+        image_digest.trailoff(15):label=WASM_IMAGE_DIGEST,
+        plugin_config_data.len().size(zero="-"):label=CONFIG_SIZE,
+        plugin_config_uri:label=CONFIG_IMAGE,
+        plugin_config_digest.yesno(no='').trailoff(15):label=CONFIG_IMAGE_DIGEST,
+        updateTime.date():label=UPDATE_TIME:sort=1
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/wasm_plugins/__init__.py

@@ -0,0 +1,29 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google Inc. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The wasm-plugin-versions command group for Service Extensions."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+class WasmPlugins(base.Group):
+  """Interact with and manage Service Extensions `WasmPlugins`."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/wasm_plugins/create.py

@@ -0,0 +1,155 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""gcloud service-extensions wasm-plugins create command."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+import textwrap
+
+from googlecloudsdk.api_lib.service_extensions import wasm_plugin_api
+from googlecloudsdk.calliope import base
+from googlecloudsdk.calliope import exceptions as calliope_exceptions
+from googlecloudsdk.command_lib.service_extensions import flags
+from googlecloudsdk.command_lib.service_extensions import util
+from googlecloudsdk.command_lib.util.args import labels_util
+from googlecloudsdk.core import log
+
+
+def _GetLogConfig(args, api_version):
+  """Converts the dict representation of the log_config to proto.
+
+  Args:
+    args: args with log_level parsed ordered dict. If log-level flag is set,
+      enable option should also be set.
+    api_version: API version (e.g. v1apha1)
+
+  Returns:
+    a value of messages.WasmPluginLogConfig or None,
+    if log-level flag were not provided.
+  """
+
+  if args.log_config is None:
+    return None
+  return util.GetLogConfig(args.log_config[0], api_version)
+
+
+def GetPluginConfigData(args):
+  return args.plugin_config or args.plugin_config_file
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+class Create(base.CreateCommand):
+  """Create a `WasmPlugin` resource."""
+
+  detailed_help = {
+      'DESCRIPTION': textwrap.dedent("""\
+          Create a new `WasmPlugin` resource.
+      """),
+      'EXAMPLES': textwrap.dedent("""\
+          To create a `WasmPlugin` called `my-plugin`, together with a new
+          version called `v1`, and set it as main, run:
+
+          $ {command} my-plugin --main-version=v1
+          --image=...-docker.pkg.dev/my-project/repository/container:tag
+          """),
+  }
+
+  @classmethod
+  def Args(cls, parser):
+    api_version = util.GetApiVersion(cls.ReleaseTrack())
+    flags.AddWasmPluginResource(
+        parser=parser,
+        api_version=api_version,
+        message='The ID of the `WasmPlugin` resource to create.',
+    )
+
+    base.ASYNC_FLAG.AddToParser(parser)
+    labels_util.AddCreateLabelsFlags(parser)
+    flags.AddDescriptionFlag(parser)
+    flags.AddLogConfigFlag(parser, api_version)
+
+    flags.AddWasmPluginVersionArgs(
+        parser=parser,
+        version_message=(
+            'ID of the `WasmPluginVersion` resource that will be created for '
+            'that `WasmPlugin` and that will be set as the current '
+            'main version.'
+        ),
+    )
+
+  def Run(self, args):
+    api_version = util.GetApiVersion(self.ReleaseTrack())
+    if args.main_version is None:
+      raise calliope_exceptions.RequiredArgumentException(
+          '--main-version', 'Flag --main-version is mandatory.'
+      )
+    if not args.main_version:
+      raise calliope_exceptions.RequiredArgumentException(
+          '--main-version', 'Flag --main-version cannot be empty.'
+      )
+    if args.image is None:
+      raise calliope_exceptions.RequiredArgumentException(
+          '--image', 'Flag --image is mandatory.'
+      )
+
+    wp_client = wasm_plugin_api.Client(self.ReleaseTrack())
+
+    wasm_plugin_ref = args.CONCEPTS.wasm_plugin.Parse()
+    labels = labels_util.ParseCreateArgs(
+        args, wp_client.messages.WasmPlugin.LabelsValue
+    )
+    log_config = _GetLogConfig(args, api_version)
+
+    versions = wp_client.PrepareVersionDetailsForSingleVersion(
+        args.main_version,
+        args.image,
+        GetPluginConfigData(args),
+        args.plugin_config_uri,
+    )
+
+    op_ref = wp_client.CreateWasmPlugin(
+        parent=wasm_plugin_ref.Parent().RelativeName(),
+        name=wasm_plugin_ref.Name(),
+        description=args.description,
+        labels=labels,
+        log_config=log_config,
+        main_version=args.main_version,
+        versions=versions,
+    )
+    log.status.Print(
+        'Create request issued for: [{}]'.format(wasm_plugin_ref.Name())
+    )
+
+    if args.async_:
+      log.status.Print('Check operation [{}] for status.'.format(op_ref.name))
+      return op_ref
+
+    result = wp_client.WaitForOperation(
+        operation_ref=op_ref,
+        message='Waiting for operation [{}] to complete'.format(op_ref.name),
+    )
+
+    log.status.Print(
+        'Created WasmPlugin [{}] with WasmPluginVersion [{}].'.format(
+            wasm_plugin_ref.Name(), args.main_version
+        )
+    )
+
+    return result

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/wasm_plugins/delete.yaml

@@ -0,0 +1,29 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: Delete a `WasmPlugin` resource.
+    description: |
+      Delete a `WasmPlugin` resource.
+
+      Please note that all WasmPluginVersions associated with the WasmPlugin will also be deleted.
+    examples: |
+      To delete a `WasmPlugin` called `my-plugin`, run:
+
+        $ {command} my-plugin
+
+  request:
+    collection: networkservices.projects.locations.wasmPlugins
+    ALPHA:
+      api_version: v1alpha1
+    BETA:
+      api_version: v1beta1
+    GA:
+      api_version: v1
+
+  async:
+    collection: networkservices.projects.locations.operations
+
+  arguments:
+    resource:
+      help_text: The `WasmPlugin` resource to delete.
+      spec: !REF googlecloudsdk.command_lib.service_extensions.resources:wasmPlugin
+      is_positional: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/wasm_plugins/describe.yaml

@@ -0,0 +1,23 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: Show details about a `WasmPlugin` resource.
+    description: Show details about a `WasmPlugin` resource.
+    examples: |
+      To show details about a `WasmPlugin`, run:
+
+        $ {command} my-plugin
+
+  request:
+    collection: networkservices.projects.locations.wasmPlugins
+    ALPHA:
+      api_version: v1alpha1
+    BETA:
+      api_version: v1beta1
+    GA:
+      api_version: v1
+
+  arguments:
+    resource:
+      help_text: The `WasmPlugin` resource that you want to describe.
+      spec: !REF googlecloudsdk.command_lib.service_extensions.resources:wasmPlugin
+      is_positional: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/wasm_plugins/list.yaml

@@ -0,0 +1,35 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: List all `WasmPlugin` resources.
+    description: |
+      List `WasmPlugin` resources.
+    examples: |
+      To list existing `WasmPlugin` resources, run:
+
+        $ {command}
+
+  request:
+    collection: networkservices.projects.locations.wasmPlugins
+    ALPHA:
+      api_version: v1alpha1
+    BETA:
+      api_version: v1beta1
+    GA:
+      api_version: v1
+
+  response:
+    id_field: name
+
+  arguments:
+    resource:
+      help_text: The parent location.
+      spec: !REF googlecloudsdk.command_lib.service_extensions.resources:optionalLocation
+
+  output:
+    format: |
+      table(
+        name.basename():label=NAME,
+        description:label=DESCRIPTION,
+        mainVersionId:label=MAINVERSION,
+        updateTime:label=UPDATETIME:sort=1
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/service_extensions/wasm_plugins/update.py

@@ -0,0 +1,227 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""gcloud service-extensions wasm-plugins update command."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+import textwrap
+
+from googlecloudsdk.api_lib.service_extensions import wasm_plugin_api
+from googlecloudsdk.api_lib.service_extensions import wasm_plugin_version_api
+from googlecloudsdk.calliope import base
+from googlecloudsdk.calliope import exceptions as calliope_exceptions
+from googlecloudsdk.command_lib.service_extensions import flags
+from googlecloudsdk.command_lib.service_extensions import util
+from googlecloudsdk.command_lib.util.args import labels_util
+from googlecloudsdk.core import log
+
+
+def _GetLogConfig(args, api_version):
+  """Converts the dict representation of the log_config to proto.
+
+  Args:
+    args: args with log_level parsed ordered dict. If log-level flag is set,
+      enable option should also be set.
+    api_version: API version (e.g. v1apha1)
+
+  Returns:
+    a value of messages.WasmPluginLogConfig or None,
+    if log-level flag were not provided.
+  """
+
+  if args.log_config is None:
+    return None
+  return util.GetLogConfig(args.log_config[0], api_version)
+
+
+def GetPluginConfigData(args):
+  return args.plugin_config or args.plugin_config_file
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+class Update(base.UpdateCommand):
+  """Update a `WasmPlugin` resource."""
+
+  detailed_help = {
+      'DESCRIPTION': textwrap.dedent("""\
+          Update an existing `WasmPlugin` resource and optionally create
+          a `WasmPluginVersion` resource and set it as the main (serving) one.
+
+          If `--image` is not specified:
+              * the method only updates the `WasmPlugin` resource without
+                creating a `WasmPluginVersion`.
+              * the `--plugin-config***` flags are disallowed.
+              * if `--main-version` is set, then the referenced
+                `WasmPluginVersion` must already exist and it is set as the
+                main (serving) one.
+
+          If `--image` is specified:
+              * the `--main-version` flag must also be specified.
+              * the method updates the `WasmPlugin` resource and creates a new
+                `WasmPluginVersion` with `--main-version` name and sets it as
+                the main (serving) one.
+              * the `--plugin-config***` flags are allowed.
+              * the `--async` flag is disallowed.
+      """),
+      'EXAMPLES': textwrap.dedent("""\
+          To update a `WasmPlugin` called `my-plugin`, run:
+
+          $ {command} my-plugin --main-version=new-version
+          --description="A new description." --labels=label1=value1
+
+          To update a `WasmPlugin` called `my-plugin` and also create a new
+          version called `v1` and set it as main:
+
+          $ {command} my-plugin --main-version=v1
+          --description="A new description." --labels=label1=value1
+          --image=...-docker.pkg.dev/my-project/repository/container:tag
+          """),
+  }
+
+  @classmethod
+  def Args(cls, parser):
+    api_version = util.GetApiVersion(cls.ReleaseTrack())
+    flags.AddWasmPluginResource(
+        parser=parser,
+        api_version=api_version,
+        message='The ID of the `WasmPlugin` to update.',
+    )
+
+    base.ASYNC_FLAG.AddToParser(parser)
+    labels_util.AddCreateLabelsFlags(parser)
+    flags.AddDescriptionFlag(parser)
+    flags.AddLogConfigFlag(parser, api_version)
+
+    flags.AddWasmPluginVersionArgs(
+        parser=parser,
+        version_message="""
+            The ID of the `WasmPluginVersion` that should be the currently
+            serving one. The version referred to must be a child of this
+            `WasmPlugin`.
+
+            If the `--image` flag was also provided, the `WasmPluginVersion`
+            will be created for that `WasmPlugin` and will be set as the
+            current main version.
+        """,
+    )
+
+    # Changes the default output format.
+    parser.display_info.AddFormat('yaml')
+
+  def Run(self, args):
+    api_version = util.GetApiVersion(self.ReleaseTrack())
+    update_wasm_plugin_and_create_version = None
+    if (
+        args.main_version is not None
+        and args.image is not None
+        and not args.async_
+    ):
+      update_wasm_plugin_and_create_version = True
+    elif args.image is None:
+      update_wasm_plugin_and_create_version = False
+    elif args.main_version is None:
+      raise calliope_exceptions.RequiredArgumentException(
+          '--main-version',
+          'Both flags --image and --main-version should be set or neither of'
+          ' them.',
+      )
+    else:
+      raise calliope_exceptions.ConflictingArgumentsException(
+          '--async',
+          "If --async flag is set, --image and --config flags can't be used.",
+      )
+    # --main-version="" is not allowed.
+    if args.IsSpecified('main_version') and not args.main_version:
+      raise calliope_exceptions.RequiredArgumentException(
+          '--main-version',
+          'Flag --main-version cannot be empty.',
+      )
+    if not update_wasm_plugin_and_create_version:
+      if (
+          GetPluginConfigData(args) is not None
+          or args.plugin_config_uri is not None
+      ):
+        raise calliope_exceptions.ConflictingArgumentsException(
+            '--plugin_config or --plugin_config_file or --plugin_config_uri',
+            'If one of the flags is set, then --image and --main-version'
+            ' flags also should be set.',
+        )
+
+    wasm_plugin_ref = args.CONCEPTS.wasm_plugin.Parse()
+    main_version = args.main_version
+    if update_wasm_plugin_and_create_version:
+      wpv_client = wasm_plugin_version_api.Client(self.ReleaseTrack())
+
+      op_ref = wpv_client.CreateWasmPluginVersion(
+          parent=wasm_plugin_ref.RelativeName(),
+          name=main_version,
+          image=args.image,
+          plugin_config_data=GetPluginConfigData(args),
+          plugin_config_uri=args.plugin_config_uri,
+      )
+      log.status.Print('Create request issued for: [{}]'.format(main_version))
+
+      _ = wpv_client.WaitForOperation(
+          operation_ref=op_ref,
+          message='Waiting for operation [{}] to complete'.format(op_ref.name),
+      )
+      log.status.Print('Created WasmPluginVersion [{}].'.format(main_version))
+
+    wp_client = wasm_plugin_api.Client(self.ReleaseTrack())
+    labels = labels_util.ParseCreateArgs(
+        args, wp_client.messages.WasmPlugin.LabelsValue
+    )
+    log_config = _GetLogConfig(args, api_version)
+
+    update_mask = []
+    if args.IsSpecified('description'):
+      update_mask.append('description')
+    if args.IsSpecified('labels'):
+      update_mask.append('labels')
+    if args.IsSpecified('log_config'):
+      update_mask.append('logConfig')
+    if args.IsSpecified('main_version'):
+      update_mask.append('mainVersionId')
+
+    op_ref = wp_client.UpdateWasmPlugin(
+        name=wasm_plugin_ref.RelativeName(),
+        main_version=main_version,
+        update_mask=','.join(sorted(update_mask)),
+        description=args.description,
+        labels=labels,
+        log_config=log_config,
+    )
+
+    log.status.Print(
+        'Update request issued for: [{}]'.format(wasm_plugin_ref.Name())
+    )
+
+    if args.async_:
+      log.status.Print('Check operation [{}] for status.'.format(op_ref.name))
+      return op_ref
+
+    result = wp_client.WaitForOperation(
+        operation_ref=op_ref,
+        message='Waiting for operation [{}] to complete'.format(op_ref.name),
+    )
+
+    log.status.Print('Updated WasmPlugin [{}].'.format(wasm_plugin_ref.Name()))
+
+    return result