feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/surface/zone_management/__init__.py

@@ -0,0 +1,31 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The Zone Management command group."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class ZoneManagement(base.Group):
+  """Zone Management gcloud commands."""
+  category = base.GDCC_ZONE_CATEGORY
+
+  def Filter(self, context, args):
+    del context, args

gcloud auth application-default login/google-cloud-sdk/lib/surface/zone_management/auth/__init__.py

@@ -0,0 +1,40 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The Zone Management Service command group."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.projects import util
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class ZoneManagementAuth(base.Group):
+  """Zone Management Auth gcloud commands."""
+
+  category = base.GDCC_ZONE_CATEGORY
+
+  @staticmethod
+  def Args(parser):
+    parser.display_info.AddUriFunc(util.ProjectsUriFunc)
+
+  def Filter(self, context, args):
+    del context, args
+    # Don't ever take this off. Use gcloud quota for projects operations so
+    # you can create a project before you have a project.
+    base.DisableUserProjectQuota()

gcloud auth application-default login/google-cloud-sdk/lib/surface/zone_management/auth/print_identity_token.py

@@ -0,0 +1,77 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command to print an identity token for a specified audience."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from google.auth import exceptions as google_auth_exceptions
+from google.oauth2 import gdch_credentials
+from googlecloudsdk.calliope import base
+from googlecloudsdk.core import log
+from googlecloudsdk.core import requests
+
+
+def AddCredFileArg(parser):
+  parser.add_argument(
+      '--cred-file',
+      required=True,
+      type=str,
+      metavar='CRED_FILE',
+      help='Path to a credential file.')
+
+
+def AddAudienceArg(parser):
+  parser.add_argument(
+      '--audience',
+      required=True,
+      type=str,
+      metavar='AUDIENCE',
+      help='Intended recipient of the token. '
+           'Currently, only one audience can be specified.')
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class IdentityToken(base.DescribeCommand):
+  """Print an identity token for a specified audience.
+
+  ## EXAMPLES
+
+    $ {command} --audience=https://example.com --cred-file=/tmp/cred.json
+  """
+
+  @staticmethod
+  def Args(parser):
+    AddCredFileArg(parser)
+    AddAudienceArg(parser)
+
+  def Run(self, args):
+    credential = (
+        gdch_credentials.ServiceAccountCredentials.from_service_account_file(
+            args.cred_file
+        )
+    )
+    credential = credential.with_gdch_audience(args.audience)
+
+    try:
+      credential.refresh(requests.GoogleAuthRequest())
+    except google_auth_exceptions.RefreshError as e:
+      log.error('Failed to refresh credentials: %s', e)
+      return None
+
+    log.out.Print(credential.token)
+    return None

gcloud auth application-default login/google-cloud-sdk/lib/surface/zone_management/identity_providers/__init__.py

@@ -0,0 +1,24 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The Zone Management Service Identity Provider command group."""
+
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class ZoneManagementServiceIdentityProvider(base.Group):
+  """Zone Management Service Identity Provider gcloud commands."""
+  category = base.GDCC_ZONE_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/zone_management/identity_providers/create.yaml

@@ -0,0 +1,25 @@
+- release_tracks: [ALPHA]
+
+  help_text:
+    brief: create identity provider
+    description: Creates an identity provider.
+    examples: |
+      To create an identity provider called `test-identity-provider` in organization `test-org`, location `us-central1` with the contents of `test-config.json`:
+
+      $ {command} test-identity-provider --location=us-central1 --organization=test-org --config=test-config.json
+
+  request:
+    collection: edgecontainer.organizations.locations.identityProviders
+    api_version: v1alpha
+    method: create
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.zone_management.identity_provider.hooks:AddOidcConfigToRequest
+
+  arguments:
+    resource:
+      help_text: Identity Provider to create.
+      spec: !REF googlecloudsdk.command_lib.zone_management.identity_provider.resources:identityProvider
+    params:
+    - arg_name: config
+      help_text: The identity provider configuration file.
+      required: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/zone_management/identity_providers/delete.yaml

@@ -0,0 +1,27 @@
+- release_tracks: [ALPHA]
+
+  help_text:
+    brief: |
+      delete identity provider.
+    description: |
+      Deletes an identity provider.
+    examples: |
+      To delete an identity provider called `test-identity-provider` in organization `test-org`, location `us-central1` and zone `test-zone`:
+
+      $ {command} delete test-identity-provider --location=us-central1 --organization=test-org --zone=test-zone
+
+  request:
+    collection: edgecontainer.organizations.locations.identityProviders
+    api_version: v1alpha
+    method: delete
+
+  arguments:
+    resource:
+      help_text: The identity provider to delete.
+      spec: !REF googlecloudsdk.command_lib.zone_management.identity_provider.resources:identityProvider
+    params:
+    - arg_name: zone
+      api_field: zoneId
+      required: true
+      help_text: |
+        Zone of the identity provider.

gcloud auth application-default login/google-cloud-sdk/lib/surface/zone_management/identity_providers/describe.yaml

@@ -0,0 +1,27 @@
+- release_tracks: [ALPHA]
+
+  help_text:
+    brief: |
+      describes an identity provider.
+    description: |
+      Describes an identity provider.
+    examples: |
+      To describe an identity provider called `test-identity-provider` in organization `test-org`, location `us-central1` and zone `test-zone`:
+
+      $ {command} test-identity-provider --location=us-central1 --organization=test-org --zone=test-zone
+
+  request:
+    collection: edgecontainer.organizations.locations.identityProviders
+    api_version: v1alpha
+    method: get
+
+  arguments:
+    resource:
+      help_text: The identity provider to describe.
+      spec: !REF googlecloudsdk.command_lib.zone_management.identity_provider.resources:identityProvider
+    params:
+    - arg_name: zone
+      api_field: zoneId
+      required: true
+      help_text: |
+        Zone of the identity provider.

gcloud auth application-default login/google-cloud-sdk/lib/surface/zone_management/identity_providers/list.yaml

@@ -0,0 +1,28 @@
+- release_tracks: [ALPHA]
+
+  help_text:
+    brief: list identity providers
+    description: Lists identity providers in a given organization and location.
+    examples: |
+      To list identity providers in organization `test-org`, location `us-central1` and zone `test-zone`, run:
+
+      $ {command} --location=us-central1 --organization=test-org --zone=test-zone
+
+  request:
+    collection: edgecontainer.organizations.locations.identityProviders
+    ALPHA:
+      api_version: v1alpha
+
+  response:
+    id_field: name
+
+  arguments:
+    resource:
+      help_text: Parent Edge Container location to list all identity providers.
+      spec: !REF googlecloudsdk.command_lib.zone_management.identity_provider.resources:location
+    params:
+    - arg_name: zone
+      api_field: zoneId
+      required: true
+      help_text: |
+        Zone of the identity provider.

gcloud auth application-default login/google-cloud-sdk/lib/surface/zone_management/projects/__init__.py

@@ -0,0 +1,28 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The Zone Management Project command group."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class ZoneManagementProject(base.Group):
+  """Zone Management Project gcloud commands."""
+  category = base.GDCC_ZONE_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/zone_management/projects/describe.yaml

@@ -0,0 +1,19 @@
+release_tracks: [ALPHA]
+
+help_text:
+  brief: describe zonal project
+  description: Describe a zonal project.
+  examples: |
+    To describe a zonal project `test-zonal-project` in zone `test-zone` in organization `test-org` and location `us-central1`, run:
+
+    $ {command} test-zonal-project --location=us-central1 --zone=test-zone --organization=test-org
+
+request:
+  collection: edgecontainer.organizations.locations.zones.zonalProjects
+  api_version: v1alpha
+  method: get
+
+arguments:
+  resource:
+    help_text: Zonal Project
+    spec: !REF googlecloudsdk.command_lib.zone_management.project.resources:zonalProject

gcloud auth application-default login/google-cloud-sdk/lib/surface/zone_management/projects/enable.yaml

@@ -0,0 +1,40 @@
+- release_tracks: [ALPHA]
+
+  help_text:
+    brief: enable zonal project
+    description: Enables a zonal project.
+    examples: |
+      To enable a project called `test-project` in zone `test-zone` in organization `test-org` and location `us-central1`, run:
+
+      $ {command} test-project --location=us-central1 --zone=test-zone --organization=test-org
+
+  request:
+    collection: edgecontainer.organizations.locations.zones.zonalProjects
+    api_version: v1alpha
+    method: enable
+
+  arguments:
+    resource:
+      help_text: Zonal Project
+      spec: !REF googlecloudsdk.command_lib.zone_management.project.resources:zonalProject
+    params:
+    - arg_name: organization
+      resource_spec: !REF googlecloudsdk.command_lib.zone_management.project.resources:organization
+      required: true
+      help_text: |
+        Organization of the zonal project.
+    - arg_name: location
+      resource_spec: !REF googlecloudsdk.command_lib.zone_management.project.resources:location
+      required: true
+      help_text: |
+        Location of the zonal project.
+    - arg_name: zone
+      resource_spec: !REF googlecloudsdk.command_lib.zone_management.project.resources:zone
+      is_parent_resource: true
+      is_primary_resource: false
+      required: true
+      help_text: |
+        Zone of the zonal project.
+
+  async:
+    collection: edgecontainer.organizations.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/zone_management/projects/list.yaml

@@ -0,0 +1,22 @@
+- release_tracks: [ALPHA]
+
+  help_text:
+    brief: List Zonal Projects
+    description: Lists zonal projects in a given project and location.
+    examples: |
+      To list zonal projects in zone `test-zone` in organization `test-org` and location `us-central1`, run:
+
+      $ {command} --location=us-central1 --zone=test-zone --organization=test-org
+
+  request:
+    collection: edgecontainer.organizations.locations.zones.zonalProjects
+    ALPHA:
+      api_version: v1alpha
+
+  response:
+    id_field: name
+
+  arguments:
+    resource:
+      help_text: Parent Edge Container location to list all zonal projects in a given location, zone and organization.
+      spec: !REF googlecloudsdk.command_lib.zone_management.project.resources:zone

gcloud auth application-default login/google-cloud-sdk/lib/surface/zone_management/service_accounts/__init__.py

@@ -0,0 +1,28 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The Zone Management Service Account command group."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class ZoneManagementServiceAccount(base.Group):
+  """Zone Management Service Account gcloud commands."""
+  category = base.GDCC_ZONE_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/zone_management/service_accounts/create.yaml

@@ -0,0 +1,27 @@
+- release_tracks: [ALPHA]
+
+  help_text:
+    brief: create service account
+    description: Creates a service account.
+    examples: |
+      To create a service account called `test-service-account` in project `test-project` and location `us-central1`, run:
+
+      $ {command} test-service-account --location=us-central1 --project=test-project --zone=us-central1-edge-zone1
+
+  request:
+    collection: edgecontainer.projects.locations.serviceAccounts
+    api_version: v1alpha
+    method: create
+
+  arguments:
+    resource:
+      help_text: Service Account to create.
+      spec: !REF googlecloudsdk.command_lib.zone_management.service_account.resources:serviceAccount
+    params:
+    - arg_name: zone
+      api_field: serviceAccount.zone
+      required: true
+      help_text: Zone name.
+
+  async:
+    collection: edgecontainer.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/zone_management/service_accounts/delete.yaml

@@ -0,0 +1,22 @@
+- release_tracks: [ALPHA]
+
+  help_text:
+    brief: delete service account
+    description: Deletes a service account.
+    examples: |
+      To delete a service account called `test-service-account` in project `test-project` and location `us-central1`, run:
+
+      $ {command} test-service-account --location=us-central1 --project=test-project
+
+  request:
+    collection: edgecontainer.projects.locations.serviceAccounts
+    api_version: v1alpha
+    method: delete
+
+  arguments:
+    resource:
+      help_text: Service account to delete.
+      spec: !REF googlecloudsdk.command_lib.zone_management.service_account.resources:serviceAccount
+
+  async:
+    collection: edgecontainer.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/zone_management/service_accounts/describe.yaml

@@ -0,0 +1,19 @@
+release_tracks: [ALPHA]
+
+help_text:
+  brief: describe service account
+  description: Describes a service account.
+  examples: |
+    To describe a service account called `test-service-account` in project `test-project` and location `us-central1`, run:
+
+    $ {command} test-service-account --location=us-central1 --project=test-project
+
+request:
+  collection: edgecontainer.projects.locations.serviceAccounts
+  api_version: v1alpha
+  method: get
+
+arguments:
+  resource:
+    help_text: Service Account
+    spec: !REF googlecloudsdk.command_lib.zone_management.service_account.resources:serviceAccount

gcloud auth application-default login/google-cloud-sdk/lib/surface/zone_management/service_accounts/keys/__init__.py

@@ -0,0 +1,28 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The Zone Management Service Account Keys command group."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class ZoneManagementServiceAccountKeys(base.Group):
+  """Zone Management Service Account Keys gcloud commands."""
+  category = base.GDCC_ZONE_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/zone_management/service_accounts/keys/create.yaml

@@ -0,0 +1,33 @@
+- release_tracks: [ALPHA]
+  command_type: GENERIC
+  help_text:
+    brief: Creates service account key.
+    description: Creates service account key.
+    examples: |
+      To create service account key for a service account called `test-service-account` in project `test-project` and location `us-central1`, run:
+
+      $ {command} --service_account=test-service-account --location=us-central1 --project=test-project
+
+  request:
+    collection: edgecontainer.projects.locations.serviceAccounts
+    api_version: v1alpha
+    method: generateKey
+
+  arguments:
+    resource:
+      help_text: Service Account to create key for.
+      spec: !REF googlecloudsdk.command_lib.zone_management.service_account.resources:serviceAccount
+      is_positional: false
+      arg_name: service-account
+    params:
+    - arg_name: ca-cert-path
+      api_field: generateServiceAccountKeyRequest.caCertPath
+      help_text: Path to the CA certificate file.
+    - arg_name: output_file
+      is_positional: true
+      required: true
+      help_text: Path to the file to write the private key response to.
+
+  response:
+    modify_response_hooks:
+    - googlecloudsdk.command_lib.zone_management.service_account.hooks:PossiblyWritePrivateKeyToOutputFile

gcloud auth application-default login/google-cloud-sdk/lib/surface/zone_management/service_accounts/list.yaml

@@ -0,0 +1,22 @@
+- release_tracks: [ALPHA]
+
+  help_text:
+    brief: List service accounts
+    description: Lists service accounts in a given project and location.
+    examples: |
+      To list service accounts in project `test-project` and location `us-central1`, run:
+
+      $ {command} --location=us-central1 --project=test-project
+
+  request:
+    collection: edgecontainer.projects.locations.serviceAccounts
+    ALPHA:
+      api_version: v1alpha
+
+  response:
+    id_field: name
+
+  arguments:
+    resource:
+      help_text: Parent Edge Container location to list all service accounts.
+      spec: !REF googlecloudsdk.command_lib.zone_management.service_account.resources:location

gcloud auth application-default login/google-cloud-sdk/lib/surface/zone_management/services/__init__.py

@@ -0,0 +1,28 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The Zone Management Service command group."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class ZoneManagementService(base.Group):
+  """Zone Management Service gcloud commands."""
+  category = base.GDCC_ZONE_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/zone_management/services/describe.yaml

@@ -0,0 +1,19 @@
+release_tracks: [ALPHA]
+
+help_text:
+  brief: describe zonal service
+  description: Describes a zonal service.
+  examples: |
+    To describe a zonal service with Id `zonal-service-id` in project `test-project` and location `us-central1`, run:
+
+    $ {command} zonal-service-id --location=us-central1 --project=test-project
+
+request:
+  collection: edgecontainer.projects.locations.zonalServices
+  api_version: v1alpha
+  method: get
+
+arguments:
+  resource:
+    help_text: Zonal Service Id
+    spec: !REF googlecloudsdk.command_lib.zone_management.service.resources:zonalService

gcloud auth application-default login/google-cloud-sdk/lib/surface/zone_management/services/enable.yaml

@@ -0,0 +1,44 @@
+- release_tracks: [ALPHA]
+  command_type: CREATE
+
+  help_text:
+    brief: enable zonal service
+    description: Enables a zonal service.
+    examples: |
+      To enable `vertex` service in location `us-central1` in `test-project` project and `test-zone` zone, run:
+
+      $ {command} vertex --location=us-central1 --project=test-project --zone=test-zone
+
+  request:
+    collection: edgecontainer.projects.locations.zonalServices
+    api_version: v1alpha
+    method: enable
+    display_resource_type: zonal service on location
+
+  arguments:
+    resource:
+      help_text: location.
+      spec: !REF googlecloudsdk.command_lib.zone_management.service.resources:location
+      is_parent_resource: true
+      is_positional: false
+    params:
+    - arg_name: id
+      api_field: enableZonalServiceRequest.zonalServiceId
+      required: false
+      help_text: Zonal service ID.
+    - arg_name: zone
+      api_field: enableZonalServiceRequest.zonalService.zone
+      help_text: |
+        Distributed Cloud Zone.
+    - arg_name: cluster
+      api_field: enableZonalServiceRequest.zonalService.cluster
+      help_text: Cluster name.
+    - arg_name: service_selector
+      api_field: enableZonalServiceRequest.zonalService.serviceSelector
+      required: true
+      is_positional: true
+      help_text: |
+        service name.
+
+  async:
+    collection: edgecontainer.projects.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/zone_management/services/list.yaml

@@ -0,0 +1,22 @@
+- release_tracks: [ALPHA]
+
+  help_text:
+    brief: List Zonal Services
+    description: Lists zonal services in a given project and location.
+    examples: |
+      To list zonal services in project `test-project` and location `us-central1`, run:
+
+      $ {command} --location=us-central1 --project=test-project
+
+  request:
+    collection: edgecontainer.projects.locations.zonalServices
+    ALPHA:
+      api_version: v1alpha
+
+  response:
+    id_field: name
+
+  arguments:
+    resource:
+      help_text: Parent Edge Container location to list all zonal services.
+      spec: !REF googlecloudsdk.command_lib.zone_management.service.resources:location

gcloud auth application-default login/google-cloud-sdk/lib/surface/zone_management/zones/__init__.py

@@ -0,0 +1,24 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The Zone Management Zone command group."""
+
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class ZoneManagementZone(base.Group):
+  """Zone Management Zone gcloud commands."""
+  category = base.GDCC_ZONE_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/zone_management/zones/describe.yaml

@@ -0,0 +1,15 @@
+- release_tracks: [ALPHA]
+  help_text:
+    brief: describe zone
+    description: Describes a zone.
+    examples: |
+      To describe a zone called `test-zone` in organization `test-org` and location `us-central1`, run:
+      $ {command} test-zone --location=us-central1 --organization=test-org
+  request:
+    collection: edgecontainer.organizations.locations.zones
+    api_version: v1alpha
+    method: get
+  arguments:
+    resource:
+      help_text: Zone
+      spec: !REF googlecloudsdk.command_lib.zone_management.zone.resources:zone

gcloud auth application-default login/google-cloud-sdk/lib/surface/zone_management/zones/get_iam_policy.yaml

@@ -0,0 +1,20 @@
+- release_tracks: [ALPHA]
+
+  help_text:
+    brief: get IAM policy for a project on the zone
+    description: Gets the IAM policy for a project on the zone.
+    examples: |
+      To get the IAM policy for a project called `test-project` on the zone `test-zone` in location `us-central1`, run:
+
+      $ {command} test-zone --project=test-project --location=us-central1
+
+  request:
+    collection: edgecontainer.projects.locations.zones
+    api_version: v1alpha
+
+  arguments:
+    resource:
+      help_text: |
+        The name of the zone where the project is enabled.
+      is_positional: true
+      spec: !REF googlecloudsdk.command_lib.zone_management.zone.resources:projzone

gcloud auth application-default login/google-cloud-sdk/lib/surface/zone_management/zones/list.yaml

@@ -0,0 +1,22 @@
+- release_tracks: [ALPHA]
+
+  help_text:
+    brief: list zones
+    description: Lists zones in a given organization and location.
+    examples: |
+      To list zones in organization `test-org` and location `us-central1`, run:
+
+      $ {command} --location=us-central1 --organization=test-org
+
+  request:
+    collection: edgecontainer.organizations.locations.zones
+    ALPHA:
+      api_version: v1alpha
+
+  response:
+    id_field: name
+
+  arguments:
+    resource:
+      help_text: Parent Edge Container location to list all zones.
+      spec: !REF googlecloudsdk.command_lib.zone_management.zone.resources:orglocation

gcloud auth application-default login/google-cloud-sdk/lib/surface/zone_management/zones/set_iam_policy.yaml

@@ -0,0 +1,26 @@
+- release_tracks: [ALPHA]
+
+  help_text:
+    brief: set IAM policy for a project on the zone
+    description: Sets the IAM policy for a project on the zone.
+    examples: |
+      To set the IAM policy for a project called `test-project` in zone `test-zone` in location `us-central1` from a local file `test-policy.json`, run:
+
+      $ {command} --project=test-project --location=us-central1 --zone=test-zone test-policy.json
+
+  request:
+    collection: edgecontainer.projects.locations.zones
+    api_version: v1alpha
+
+  arguments:
+    resource:
+      help_text: |
+        The name of the zone to set the IAM policy for the project in.
+      is_positional: false
+      spec: !REF googlecloudsdk.command_lib.zone_management.zone.resources:projzone
+
+  iam:
+    set_iam_policy_request_path: setIamPolicyRequest
+    message_type_overrides:
+      policy: IamPolicy
+      set_iam_policy_request: EdgecontainerProjectsLocationsZonesSetIamPolicyRequest